permdock 0.16.0 → 0.17.0

package/dist/ssf/index.d.ts

@@ -1,4 +1,4 @@
-import { A as SsfSubject, C as SsfEventName, D as SsfReceiver, E as SsfPermDockOptions, M as SsfTransmitterConfiguration, N as SsfVerification, O as SsfStreamConfiguration, S as SsfEventListener, T as SsfPermDock, _ as SetSubject, a as PollHandle, b as SsfEventHandler, c as PushSetOptions, d as SetDelivery, f as SetDeliveryFailureCause, g as SetQueue, h as SetPollHandlerOptions, i as CaepReason, j as SsfSubjectResolver, k as SsfStreamStatus, l as ReplayStore, m as SetEvent, n as CaepEventName, o as PollOptions, p as SetError, r as CaepInitiatingEntity, s as PollResult, t as CaepCommon, u as RiscEventName, v as SignSetOptions, w as SsfOnEvent, x as SsfEventInput, y as SsfAuditEvent } from "../types-DsHGPtkR.js";
-import { t as memoryReplayStore } from "../replay-Bs9Df2fQ.js";
-import { A as createPermDock, C as memorySsfStreamStore, D as PollSetsResult, E as PollSetsOptions, O as PolledSet, S as SsfStreamStore, T as setPollHandler, _ as SsfFanOut, a as CaepTokenClaimsChange, b as ssfTransmitter, c as RiscEvents, d as caepEvents, f as pushSet, g as FanOutSetOptions, h as streamVerificationEvent, i as CaepEvents, k as pollSets, l as SSF_POLL_DELIVERY, m as signSet, n as CaepCredentialChange, o as RiscAccountDisabled, p as riscEvents, r as CaepDeviceComplianceChange, s as RiscCredentialCompromise, t as CaepAssuranceLevelChange, u as SSF_PUSH_DELIVERY, v as SsfTransmitterOptions, w as memorySetQueue, x as SsfStream, y as fanOutSet } from "../index-BinlXeU-.js";
+import { A as SsfSubject, C as SsfEventName, D as SsfReceiver, E as SsfPermDockOptions, M as SsfTransmitterConfiguration, N as SsfVerification, O as SsfStreamConfiguration, S as SsfEventListener, T as SsfPermDock, _ as SetSubject, a as PollHandle, b as SsfEventHandler, c as PushSetOptions, d as SetDelivery, f as SetDeliveryFailureCause, g as SetQueue, h as SetPollHandlerOptions, i as CaepReason, j as SsfSubjectResolver, k as SsfStreamStatus, l as ReplayStore, m as SetEvent, n as CaepEventName, o as PollOptions, p as SetError, r as CaepInitiatingEntity, s as PollResult, t as CaepCommon, u as RiscEventName, v as SignSetOptions, w as SsfOnEvent, x as SsfEventInput, y as SsfAuditEvent } from "../types-CJC1aaoJ.js";
+import { t as memoryReplayStore } from "../replay-Dc3d8LhG.js";
+import { A as createPermDock, C as memorySsfStreamStore, D as PollSetsResult, E as PollSetsOptions, O as PolledSet, S as SsfStreamStore, T as setPollHandler, _ as SsfFanOut, a as CaepTokenClaimsChange, b as ssfTransmitter, c as RiscEvents, d as caepEvents, f as pushSet, g as FanOutSetOptions, h as streamVerificationEvent, i as CaepEvents, k as pollSets, l as SSF_POLL_DELIVERY, m as signSet, n as CaepCredentialChange, o as RiscAccountDisabled, p as riscEvents, r as CaepDeviceComplianceChange, s as RiscCredentialCompromise, t as CaepAssuranceLevelChange, u as SSF_PUSH_DELIVERY, v as SsfTransmitterOptions, w as memorySetQueue, x as SsfStream, y as fanOutSet } from "../index-z44pfWar.js";
 export { type CaepAssuranceLevelChange, type CaepCommon, type CaepCredentialChange, type CaepDeviceComplianceChange, type CaepEventName, type CaepEvents, type CaepInitiatingEntity, type CaepReason, type CaepTokenClaimsChange, type FanOutSetOptions, type PollHandle, type PollOptions, type PollResult, type PollSetsOptions, type PollSetsResult, type PolledSet, type PushSetOptions, type ReplayStore, type RiscAccountDisabled, type RiscCredentialCompromise, type RiscEventName, type RiscEvents, SSF_POLL_DELIVERY, SSF_PUSH_DELIVERY, type SetDelivery, type SetDeliveryFailureCause, type SetError, type SetEvent, type SetPollHandlerOptions, type SetQueue, type SetSubject, type SignSetOptions, type SsfAuditEvent, type SsfEventHandler, type SsfEventInput, type SsfEventListener, type SsfEventName, type SsfFanOut, type SsfOnEvent, type SsfPermDock, type SsfPermDockOptions, type SsfReceiver, type SsfStream, type SsfStreamConfiguration, type SsfStreamStatus, type SsfStreamStore, type SsfSubject, type SsfSubjectResolver, type SsfTransmitterConfiguration, type SsfTransmitterOptions, type SsfVerification, caepEvents, createPermDock, fanOutSet, memoryReplayStore, memorySetQueue, memorySsfStreamStore, pollSets, pushSet, riscEvents, setPollHandler, signSet, ssfTransmitter, streamVerificationEvent };

package/dist/ssf/index.js

@@ -3,7 +3,7 @@ import { o as statusProblem } from "../problem-details-CLDgX1KV.js";
 import { o as epochSeconds } from "../time-nR1JesoH.js";
 import { n as readBodyText } from "../body-text-DQhcmqdY.js";
 import { f as validationProblem, l as problemResponse, o as methodNotAllowed, s as notFoundProblem } from "../problem-BVLHFK33.js";
-import { t as cancelApprovals } from "../helpers-DJicaG6f.js";
+import { t as cancelApprovals } from "../helpers-DNnZffrI.js";
 import { i as issuerFromDiscovery, t as joseTokenVerifier } from "../verifier-DUV6pLqZ.js";
 import { t as memoryReplayStore } from "../replay-BU09ad4L.js";
 import { t as timeoutSignal } from "../timeout-D51niuQP.js";

package/dist/{standard-webhooks-DOYEuOLx.d.ts → standard-webhooks-BFeEpjxy.d.ts}

@@ -1,5 +1,5 @@
-import { Wt as Instant, dr as JsonWebKeyLike } from "./policy-types-DGIO_gxq.js";
-import { l as ReplayStore } from "./types-DsHGPtkR.js";
+import { Kt as Instant, hr as JsonWebKeyLike } from "./policy-types-IRJVABmm.js";
+import { l as ReplayStore } from "./types-CJC1aaoJ.js";
 //#region src/server/standard-webhooks.d.ts
 /** The three Standard Webhooks headers a delivery carries. */
 type WebhookHeaders = {

package/dist/{store-RNFvaJJv.js → store-XgBMbfDy.js}

@@ -1,9 +1,10 @@
 import { t as compact } from "./compact-CAf557ZB.js";
 import { n as freezeDeep } from "./freeze-jjan0lCv.js";
-import { i as flattenApprovers } from "./approvers-B4r0N_Uz.js";
+import { a as flattenApprovers, i as approverManagerKey } from "./approvers-CNtl4Vc5.js";
 import { a as durationOf, i as dateAt } from "./time-nR1JesoH.js";
-import { c as rootMembershipId } from "./scopes-0Up_UA2t.js";
-import { n as matchGrantee } from "./grantee-match-7RZZvoT_.js";
+import { o as readWireApproval } from "./approval-normalize-4KxMRdJC.js";
+import { i as rootMembershipId } from "./subject-C7RddW0G.js";
+import { n as matchGrantee } from "./grantee-match-BP-k4vRJ.js";
 import { a as escalationOpenAt, i as approverRelationKey, o as stageEscalationOpenAt, r as approvalQuorum, s as ApprovalError } from "./types-CcUXciSj.js";
 //#region src/approvals/page.ts
 const DEFAULT_PAGE_SIZE = 50;
@@ -133,6 +134,10 @@ function matchesApprovers(by, subject, tenant, now, facts) {
 			if (subject.principal?.id !== item.id) return false;
 			continue;
 		}
+		if (item.kind === "manager") {
+			if (!facts.relations.has(approverManagerKey(item))) return false;
+			continue;
+		}
 		if (item.kind === "relation") {
 			if (!facts.relations.has(approverRelationKey(item))) return false;
 			continue;
@@ -168,7 +173,8 @@ function assertSeparateApprover(request, by, requireDistinctApprover) {
 	if (principal.kind === "link" || principal.kind === "feed" || principal.kind === "contact") throw new ApprovalError("approver-not-eligible", "a link, a feed or a contact cannot approve");
 	if (by.actor?.kind === "support") throw new ApprovalError("approver-not-eligible", "a support session cannot approve");
 	if (request.subject.actor !== void 0 && principal.id === request.subject.actor.id) throw new ApprovalError("approver-is-actor", "approver is the actor of this request");
-	if ((requireDistinctApprover || request.approvers?.distinct !== false) && request.subject.principal !== null && principal.id === request.subject.principal.id) throw new ApprovalError("approver-is-principal", "approver is the principal of this request");
+	if ((requireDistinctApprover || readWireApproval(request.approvers)?.mode !== "confirm") && request.subject.principal !== null && principal.id === request.subject.principal.id) throw new ApprovalError("approver-is-principal", "approver is the principal of this request");
+	if (by.actor !== void 0 && !isSystemSubject(by) || by.delegation !== void 0 || principal.kind === "service" || principal.kind === "workload") throw new ApprovalError("approver-not-eligible", "an approver must be a person acting for themselves, not an agent, a delegated token or a service");
 	return principal;
 }
 function assertNotRepeated(request, id) {
@@ -193,7 +199,7 @@ function assertApprover(request, by, requireDistinctApprover, at, relations = []
 	const tenant = request.subject.principal?.tenant;
 	if (tenant !== void 0 && !belongsToTenant(by, tenant)) throw new ApprovalError("approver-not-eligible", "approver does not belong to the request tenant");
 	assertNotRepeated(request, principal.id);
-	const approvers = request.approvers;
+	const approvers = readWireApproval(request.approvers);
 	if (approvers === void 0) return;
 	const facts = {
 		relations: new Set(relations),
@@ -214,12 +220,12 @@ function assertApprover(request, by, requireDistinctApprover, at, relations = []
 	}
 	const counts = stageCounts(request.approvals, stages);
 	const open = stages.flatMap((stage, index) => (counts[index] ?? 0) < (stage.quorum ?? 1) ? [index] : []);
-	const candidates = approvers.mode === "sequential" ? open.slice(0, 1) : open;
+	const candidates = approvers.combine === "sequential" ? open.slice(0, 1) : open;
 	for (const index of candidates) {
 		const stage = stages[index];
 		if (stage !== void 0 && (escalated || eligible(stage.by) || stageEscalated(stage))) return index;
 	}
-	throw new ApprovalError("approver-not-eligible", approvers.mode === "sequential" ? "approver is not eligible for the current stage" : "approver is not eligible for an open stage");
+	throw new ApprovalError("approver-not-eligible", approvers.combine === "sequential" ? "approver is not eligible for the current stage" : "approver is not eligible for an open stage");
 }
 function isSystemSubject(by) {
 	return by.actor?.kind === "system";

package/dist/{types-tQB2CEnY.d.ts → store-g5ctUrOI.d.ts}

@@ -1,123 +1,29 @@
-import { Un as Decision, Zt as Snapshot, ht as TokenVerifier, j as PolicyVocabulary, lr as Delegation, pr as Principal, rr as Actor } from "./policy-types-DGIO_gxq.js";
+import { $t as Snapshot, M as PolicyVocabulary, _r as Principal, _t as TokenVerifier, pr as Delegation, qn as Decision, sr as Actor } from "./policy-types-IRJVABmm.js";
 import { u as Permission } from "./permission-types-CAY-GU7e.js";
-import { a as PermDock } from "./permdock-CprAPN3w.js";
-import { n as DescribeMessages, t as DecisionDescription } from "./describe-BbFPBSms.js";
-import { t as ActionResult } from "./action-result-BcudBQOF.js";
-//#region src/client/refresh-on.d.ts
-/**
- * Calls `refresh` when the snapshot may be out of date (a membership event, a
- * window focus, a realtime message) and returns the unsubscribe. A refresh
- * re-fetches the signed snapshot; it never grants by itself.
- */
-type RefreshTrigger = (refresh: () => void) => () => void;
-type EventSourceRefreshOptions = {
-  /**
-   * CloudEvent `type` values that refresh; a trailing `*` matches a prefix.
-   * Defaults to `com.permdock.membership.*` and `com.permdock.catalog.*`.
-   */
-  readonly types?: readonly string[];
-  readonly withCredentials?: boolean;
+import { a as PermDock } from "./permdock-DUWZEOLR.js";
+import { a as ProblemDetails } from "./errors-Dc9FdamT.js";
+import { n as DescribeMessages, t as DecisionDescription } from "./describe-nalX_HHE.js";
+import { r as RefreshTrigger } from "./refresh-on-L9UOwATg.js";
+//#region src/core/action-result.d.ts
+/** What a `protectAction` action resolves to; both members cross to the client. */
+type ActionResult<T> = {
+  readonly ok: true;
+  readonly value: T;
+} | {
+  readonly ok: false;
+  readonly problem: ProblemDetails;
 };
 /**
- * A `refreshOn` trigger over Server-Sent Events: each `message` whose data is a
- * structured CloudEvent with a matching `type` refreshes the snapshot. Without
- * a global `EventSource` it never fires.
+ * The server action: `approval` is the token of a granted approval request,
+ * which resumes an `approval-required` decision.
  */
-declare function eventSourceRefresh(url: string, options?: EventSourceRefreshOptions): RefreshTrigger;
+type ProtectedAction<T> = (input: unknown, options?: {
+  readonly approval?: string;
+}) => Promise<ActionResult<T>>;
 //#endregion
 //#region src/client/request.d.ts
 type StoreHeaders = Readonly<Record<string, string>>;
 //#endregion
-//#region src/client/store.d.ts
-type ClientStoreOptions = {
-  readonly snapshot: Snapshot | string;
-  readonly endpoint?: string;
-  readonly snapshotUrl?: string;
-  readonly approvals?: string;
-  readonly tenant?: string;
-  readonly fetch?: typeof fetch;
-  /**
-   * Request headers, or a getter read on every request so a rotated token needs
-   * no new store.
-   */
-  readonly headers?: StoreHeaders | (() => StoreHeaders | undefined);
-  readonly maxAge?: number;
-  readonly verifier?: TokenVerifier;
-  /**
-   * `raw` is the compact JWS the snapshot was verified from, so a signed
-   * snapshot can be persisted signed.
-   */
-  readonly onSnapshot?: (snapshot: Snapshot, tenant: string | undefined, raw: string | undefined) => void;
-  readonly onClear?: () => void;
-  /**
-   * Called once per key the snapshot cannot answer when there is no `endpoint`
-   * to ask.
-   */
-  readonly onServerOnly?: (permission: Permission) => void;
-  /**
-   * `true` while rendering on the server: endpoint checks answer `pending`
-   * without a request. Defaults to `typeof window === 'undefined'`.
-   */
-  readonly server?: boolean;
-  /** Milliseconds between approval status polls. Defaults to 2000. */
-  readonly approvalInterval?: number;
-  /** Start `pending`: the snapshot arrives later through `track()`. */
-  readonly awaiting?: boolean;
-  /**
-   * The first snapshot that hydrates with a principal is a persisted copy:
-   * `stale` until a refresh or a `replace()` lands.
-   */
-  readonly stale?: boolean;
-  /**
-   * Reuse decisions for the same row object until the next microtask. Only for
-   * renderers that do not track the fields a check reads (React): Vue, Svelte
-   * and Solid would stop re-running when a reactive row changes in place.
-   */
-  readonly passCache?: boolean;
-  /**
-   * Triggers that refresh the snapshot, started while something subscribes and
-   * never during a server render. Calls within 250 ms fold into one refresh.
-   */
-  readonly refreshOn?: readonly RefreshTrigger[];
-};
-type ClientStore = {
-  get: () => ClientPermDock;
-  subscribe: (listener: () => void) => () => void;
-  permissionState: (permission: Permission, data?: unknown) => PermissionState;
-  requestApproval: (decision: Decision, note?: string) => Promise<void>;
-  /** Hydrate from a pushed snapshot; a compact JWS goes through the verifier. */
-  replace: (value: unknown) => void;
-  /**
-   * Stay `pending` until `value` settles, then hydrate; a rejection fails
-   * closed.
-   */
-  follow: (value: PromiseLike<Snapshot | string>) => void;
-  /**
-   * `follow()` once per `value`, without suspending. A thenable React already
-   * settled (`status: 'fulfilled'`) hydrates at once.
-   */
-  track: (value: PromiseLike<Snapshot | string>) => void;
-  /**
-   * The approval state for a decision. While something subscribes, an
-   * `approval-required` decision is polled at `<approvals>/<token>`.
-   */
-  approvalState: (decision: Decision) => ApprovalState;
-  /**
-   * Hydrate from a resolved `snapshotPromise` during render. Idempotent per
-   * `source`; subscribers are notified in a microtask, never synchronously
-   * inside render.
-   */
-  adopt: (value: Snapshot | string, source: object) => void;
-  snapshot: () => Snapshot;
-  /** The tenant the store currently answers for. */
-  tenant: () => string | undefined;
-  /**
-   * Stops polls, drops in-flight results and persistence; the store keeps
-   * answering from its last snapshot.
-   */
-  dispose: () => void;
-};
-//#endregion
 //#region src/client/protected-action.d.ts
 type ProtectedActionState<T> = {
   /** The last call's answer; `undefined` before the first call. */
@@ -259,4 +165,99 @@ type GateView = {
   readonly decision: Decision;
 };
 //#endregion
-export { ClientStoreOptions as _, FilterResult as a, eventSourceRefresh as b, PermissionSet as c, ProtectedActionView as d, ProviderOptionsBase as f, ClientStore as g, TenantView as h, ClientStatus as i, PermissionState as l, SubjectView as m, ApprovalState as n, GateMode as o, RolesOptions as p, ClientPermDock as r, GateView as s, ApprovalHandle as t, ProtectedActionHandle as u, EventSourceRefreshOptions as v, RefreshTrigger as y };
+//#region src/client/store.d.ts
+type ClientStoreOptions = {
+  readonly snapshot: Snapshot | string;
+  readonly endpoint?: string;
+  readonly snapshotUrl?: string;
+  readonly approvals?: string;
+  readonly tenant?: string;
+  readonly fetch?: typeof fetch;
+  /**
+   * Request headers, or a getter read on every request so a rotated token needs
+   * no new store.
+   */
+  readonly headers?: StoreHeaders | (() => StoreHeaders | undefined);
+  readonly maxAge?: number;
+  readonly verifier?: TokenVerifier;
+  /**
+   * `raw` is the compact JWS the snapshot was verified from, so a signed
+   * snapshot can be persisted signed.
+   */
+  readonly onSnapshot?: (snapshot: Snapshot, tenant: string | undefined, raw: string | undefined) => void;
+  readonly onClear?: () => void;
+  /**
+   * Called once per key the snapshot cannot answer when there is no `endpoint`
+   * to ask.
+   */
+  readonly onServerOnly?: (permission: Permission) => void;
+  /**
+   * `true` while rendering on the server: endpoint checks answer `pending`
+   * without a request. Defaults to `typeof window === 'undefined'`.
+   */
+  readonly server?: boolean;
+  /** Milliseconds between approval status polls. Defaults to 2000. */
+  readonly approvalInterval?: number;
+  /** Start `pending`: the snapshot arrives later through `track()`. */
+  readonly awaiting?: boolean;
+  /**
+   * The first snapshot that hydrates with a principal is a persisted copy:
+   * `stale` until a refresh or a `replace()` lands.
+   */
+  readonly stale?: boolean;
+  /**
+   * Reuse decisions for the same row object until the next microtask. Only for
+   * renderers that do not track the fields a check reads (React): Vue, Svelte
+   * and Solid would stop re-running when a reactive row changes in place.
+   */
+  readonly passCache?: boolean;
+  /**
+   * Triggers that refresh the snapshot, started while something subscribes and
+   * never during a server render. Calls within 250 ms fold into one refresh.
+   */
+  readonly refreshOn?: readonly RefreshTrigger[];
+};
+type ClientStore = {
+  get: () => ClientPermDock;
+  subscribe: (listener: () => void) => () => void;
+  permissionState: (permission: Permission, data?: unknown) => PermissionState;
+  requestApproval: (decision: Decision, note?: string) => Promise<void>;
+  /** Hydrate from a pushed snapshot; a compact JWS goes through the verifier. */
+  replace: (value: unknown) => void;
+  /**
+   * Stay `pending` until `value` settles, then hydrate; a rejection fails
+   * closed.
+   */
+  follow: (value: PromiseLike<Snapshot | string>) => void;
+  /**
+   * `follow()` once per `value`, without suspending. A thenable React already
+   * settled (`status: 'fulfilled'`) hydrates at once.
+   */
+  track: (value: PromiseLike<Snapshot | string>) => void;
+  /**
+   * The approval state for a decision. While something subscribes, an
+   * `approval-required` decision is polled at `<approvals>/<token>`.
+   */
+  approvalState: (decision: Decision) => ApprovalState;
+  /**
+   * Hydrate from a resolved `snapshotPromise` during render. Idempotent per
+   * `source`; subscribers are notified in a microtask, never synchronously
+   * inside render.
+   */
+  adopt: (value: Snapshot | string, source: object) => void;
+  snapshot: () => Snapshot;
+  /** The tenant the store currently answers for. */
+  tenant: () => string | undefined;
+  /**
+   * Runs more refresh triggers until the returned stop is called, folded and
+   * skipped like `refreshOn`.
+   */
+  refreshOn: (triggers: readonly RefreshTrigger[]) => () => void;
+  /**
+   * Stops polls, drops in-flight results and persistence; the store keeps
+   * answering from its last snapshot.
+   */
+  dispose: () => void;
+};
+//#endregion
+export { TenantView as _, ClientPermDock as a, GateMode as c, PermissionState as d, ProtectedActionHandle as f, SubjectView as g, RolesOptions as h, ApprovalState as i, GateView as l, ProviderOptionsBase as m, ClientStoreOptions as n, ClientStatus as o, ProtectedActionView as p, ApprovalHandle as r, FilterResult as s, ClientStore as t, PermissionSet as u, ActionResult as v, ProtectedAction as y };

package/dist/{store-options-Dil3lraY.js → store-options--zWn48PK.js}

@@ -1,11 +1,11 @@
 import { t as compact } from "./compact-CAf557ZB.js";
 import { g as secondsOf } from "./time-nR1JesoH.js";
-import { c as rowIdOf } from "./delegation-CDB6_keF.js";
-import { c as nowSeconds } from "./tenancy-5d1zVBvK.js";
-import { n as payloadDigest } from "./token-DC9EQiet.js";
-import { n as parseSnapshot } from "./snapshot-CXlzi69u.js";
-import { c as snapshotClaim } from "./where-scope-DlCdCM_8.js";
-import { n as fromSnapshot, t as emptySnapshot } from "./from-snapshot-DCakWRsr.js";
+import { c as rowIdOf } from "./delegation-aK4T_5WU.js";
+import { c as nowSeconds } from "./tenancy-DvOHHk3-.js";
+import { r as payloadDigest } from "./token-DaMnIU9O.js";
+import { n as parseSnapshot } from "./snapshot-DN_8J27z.js";
+import { c as snapshotClaim } from "./where-scope-BKrqUDVk.js";
+import { n as fromSnapshot, t as emptySnapshot } from "./from-snapshot-DMlSSo9b.js";
 import { t as timeoutSignal } from "./timeout-D51niuQP.js";
 //#region src/client/source.ts
 /** A compact JWS: three non-empty dot-separated parts. */
@@ -270,6 +270,67 @@ function eventSourceRefresh(url, options = {}) {
 		};
 	};
 }
+function isListenerTarget(value) {
+	return typeof value === "object" && value !== null && typeof Reflect.get(value, "addEventListener") === "function" && typeof Reflect.get(value, "removeEventListener") === "function";
+}
+function listen(target, type, listener) {
+	if (!isListenerTarget(target)) return () => void 0;
+	target.addEventListener(type, listener);
+	return () => {
+		target.removeEventListener(type, listener);
+	};
+}
+/** A `refreshOn` trigger on window `focus`. Without a window it never fires. */
+function focusRefresh() {
+	return (refresh) => listen(Reflect.get(globalThis, "window"), "focus", refresh);
+}
+/**
+* A `refreshOn` trigger on `visibilitychange` to visible, when a background tab
+* comes back. Without a `document` it never fires.
+*/
+function visibilityRefresh() {
+	return (refresh) => {
+		const doc = Reflect.get(globalThis, "document");
+		return listen(doc, "visibilitychange", () => {
+			if (typeof doc === "object" && doc !== null && Reflect.get(doc, "visibilityState") === "visible") refresh();
+		});
+	};
+}
+/**
+* A `refreshOn` trigger on every message to the `BroadcastChannel` `name`, so
+* one tab that learns of a change refreshes the others. Without a global
+* `BroadcastChannel` it never fires.
+*/
+function broadcastChannelRefresh(name) {
+	return (refresh) => {
+		if (typeof globalThis.BroadcastChannel !== "function") return () => void 0;
+		const channel = new globalThis.BroadcastChannel(name);
+		channel.addEventListener("message", refresh);
+		return () => {
+			channel.close();
+		};
+	};
+}
+/**
+* A `refreshOn` trigger that fires on `notify()`. better-supabase's
+* `SessionProvider` already listens on the user's `authz:<uid>` topic and
+* shares changes across tabs, so `onAuthzChange={notify}` refreshes the
+* snapshot without a second Realtime channel.
+*/
+function authzChangeRefresh() {
+	const listeners = /* @__PURE__ */ new Set();
+	return Object.freeze({
+		trigger: (refresh) => {
+			listeners.add(refresh);
+			return () => {
+				listeners.delete(refresh);
+			};
+		},
+		notify: () => {
+			for (const listener of listeners) listener();
+		}
+	});
+}
 /**
 * Runs `triggers` while `start()` holds, folding calls within 250 ms into one
 * `refresh`. `skip()` answering `true` drops a call: after `clear()` or
@@ -759,6 +820,14 @@ function createClientStore(options) {
 		tenant() {
 			return tenant;
 		},
+		refreshOn(extra) {
+			if (server) return () => void 0;
+			const run = refreshTriggers(extra, () => {
+				cached.refresh().catch(() => void 0);
+			}, () => disposed || cleared);
+			run.start();
+			return run.stop;
+		},
 		dispose() {
 			disposed = true;
 			generation += 1;
@@ -817,4 +886,4 @@ function adapterStore(options, snapshot, native) {
 	}));
 }
 //#endregion
-export { isPromiseLike as a, isJws as i, storeOf as n, eventSourceRefresh as r, adapterStore as t };
+export { eventSourceRefresh as a, isJws as c, broadcastChannelRefresh as i, isPromiseLike as l, storeOf as n, focusRefresh as o, authzChangeRefresh as r, visibilityRefresh as s, adapterStore as t };

package/dist/{stores-DxZWDXCs.js → stores-53_kOwPi.js}

@@ -1,6 +1,6 @@
-import { n as actionRunner, t as actionApproval } from "./protected-action-DUYqb-Ma.js";
-import { a as livePermDock, c as rolesView, d as subjectView, f as tenantView, i as gateView, n as describeWith, o as permissionSet, r as filterResult, t as approvalHandle } from "./views-CD8wuL4Z.js";
-import { n as getUi, r as providePermDock, t as getStore } from "./context-BnIzxTNE.js";
+import { n as actionRunner, t as actionApproval } from "./protected-action-B6n6w7Rl.js";
+import { a as livePermDock, c as rolesView, d as subjectView, f as tenantView, i as gateView, n as describeWith, o as permissionSet, r as filterResult, t as approvalHandle } from "./views-TrZYlDnM.js";
+import { n as getUi, r as providePermDock, t as getStore } from "./context-DeammvFl.js";
 import { derived, readable, toStore, writable } from "svelte/store";
 //#region src/svelte/stores.ts
 function fromStore(store, compute) {

package/dist/{stores-DZJvxFIZ.d.ts → stores-BtdN3eDO.d.ts}

@@ -1,11 +1,10 @@
-import { Un as Decision, fr as Membership, j as PolicyVocabulary } from "./policy-types-DGIO_gxq.js";
+import { M as PolicyVocabulary, gr as Membership, qn as Decision } from "./policy-types-IRJVABmm.js";
 import { u as Permission } from "./permission-types-CAY-GU7e.js";
 import { r as Role } from "./vocabulary-DEJ5j4mR.js";
-import { d as UncheckedData, s as RowData } from "./permdock-CprAPN3w.js";
-import { r as DescribeOptions, t as DecisionDescription } from "./describe-BbFPBSms.js";
-import { n as ProtectedAction } from "./action-result-BcudBQOF.js";
-import { a as FilterResult, c as PermissionSet, h as TenantView, l as PermissionState, m as SubjectView, o as GateMode, p as RolesOptions, r as ClientPermDock, s as GateView, t as ApprovalHandle } from "./types-tQB2CEnY.js";
-import { n as ProtectedActionReadable, r as SveltePermDockOptions } from "./types-CEinc15V.js";
+import { d as UncheckedData, s as RowData } from "./permdock-DUWZEOLR.js";
+import { r as DescribeOptions, t as DecisionDescription } from "./describe-nalX_HHE.js";
+import { _ as TenantView, a as ClientPermDock, c as GateMode, d as PermissionState, g as SubjectView, h as RolesOptions, l as GateView, r as ApprovalHandle, s as FilterResult, u as PermissionSet, y as ProtectedAction } from "./store-g5ctUrOI.js";
+import { n as ProtectedActionReadable, r as SveltePermDockOptions } from "./types-DVZNTkU0.js";
 import { Readable } from "svelte/store";
 //#region src/svelte/stores.d.ts
 declare function setPermDock(options: SveltePermDockOptions): ClientPermDock;

package/dist/{stream-9y9qw51m.d.ts → stream-BMJg56jU.d.ts}

@@ -1,5 +1,5 @@
 import { u as Permission } from "./permission-types-CAY-GU7e.js";
-import { o as ProtectOptions } from "./server-types-CyRN0-Cd.js";
+import { o as ProtectOptions } from "./server-types-Bw-lWqzR.js";
 //#region src/server/stream.d.ts
 type StreamProtectOptions = ProtectOptions & {
   /**

package/dist/{subject-BGoM5o8B.js → subject-C7RddW0G.js}

@@ -7,6 +7,13 @@ function isActor(value) {
 	const record = value;
 	return typeof record.id === "string" && typeof record.kind === "string";
 }
+/**
+* A membership of the first scope itself (the only scope without a parent): its
+* id is a tenant. Needs no scope list, for code that holds only a subject.
+*/
+function rootMembershipId(membership) {
+	return membership.scope !== void 0 && membership.within === void 0 ? membership.id : void 0;
+}
 function anonymousSubject(context = {}) {
 	return Object.freeze({
 		principal: null,
@@ -14,4 +21,4 @@ function anonymousSubject(context = {}) {
 	});
 }
 //#endregion
-export { isActor as n, isSubject as r, anonymousSubject as t };
+export { rootMembershipId as i, isActor as n, isSubject as r, anonymousSubject as t };

package/dist/supabase/client.d.ts

@@ -0,0 +1,31 @@
+import { r as RefreshTrigger } from "../refresh-on-L9UOwATg.js";
+//#region src/supabase/client.d.ts
+/** The part of a supabase-js `RealtimeChannel` the trigger uses. */
+export type RealtimeRefreshChannel = {
+  readonly on: (type: "broadcast", filter: {
+    readonly event: string;
+  }, callback: (message: unknown) => void) => unknown;
+  readonly subscribe: () => unknown;
+};
+/** The part of a browser supabase-js client the trigger uses. */
+export type RealtimeRefreshClient<C extends RealtimeRefreshChannel = RealtimeRefreshChannel> = {
+  readonly channel: (topic: string, options: {
+    readonly config: {
+      readonly private: boolean;
+    };
+  }) => C;
+  readonly removeChannel: (channel: C) => unknown;
+};
+export type SupabaseRealtimeRefreshOptions = {
+  /** The signed-in user's id, the `sub` of their token. */
+  readonly userId: string;
+};
+/**
+ * A `refreshOn` trigger on the user's private `authz:<uid>` Realtime topic,
+ * where the generated version trigger sends each bump, for apps without
+ * better-supabase. The `realtime.messages` receive policy from
+ * `supabase.hook.broadcast` lets each user join only their own topic. With
+ * better-supabase, use `authzChangeRefresh` on `SessionProvider` instead.
+ */
+export declare function supabaseRealtimeRefresh<C extends RealtimeRefreshChannel>(client: RealtimeRefreshClient<C>, options: SupabaseRealtimeRefreshOptions): RefreshTrigger;
+//#endregion

package/dist/supabase/client.js

@@ -0,0 +1,21 @@
+import { r as authzUserTopic, t as AUTHZ_EVENT } from "../authz-topic-Dbc-HDOS.js";
+//#region src/supabase/client.ts
+/**
+* A `refreshOn` trigger on the user's private `authz:<uid>` Realtime topic,
+* where the generated version trigger sends each bump, for apps without
+* better-supabase. The `realtime.messages` receive policy from
+* `supabase.hook.broadcast` lets each user join only their own topic. With
+* better-supabase, use `authzChangeRefresh` on `SessionProvider` instead.
+*/
+function supabaseRealtimeRefresh(client, options) {
+	return (refresh) => {
+		const channel = client.channel(authzUserTopic(options.userId), { config: { private: true } });
+		channel.on("broadcast", { event: AUTHZ_EVENT }, refresh);
+		channel.subscribe();
+		return () => {
+			client.removeChannel(channel);
+		};
+	};
+}
+//#endregion
+export { supabaseRealtimeRefresh };

package/dist/supabase/index.d.ts

@@ -1,10 +1,23 @@
-import { Wt as Instant, hr as Subject } from "../policy-types-DGIO_gxq.js";
-import { a as ApprovalDelegationSource, m as ApprovalStore, u as ApprovalRequest } from "../types-DLvhVm1r.js";
-import { a as SupabaseRpcClient, c as readSubjectRecord, i as SupabaseRpcCaller, n as PostgrestSourcesOptions, o as SupabaseRpcResult, r as SubjectRecord, s as postgrestSources, t as PostgrestSources } from "../postgrest-D5nUGm-c.js";
-import { A as SupabaseSubjectOptions, B as supabaseClaims, C as SupabasePrincipal, D as SupabaseRlsOptions, E as SupabaseRlsMembershipTable, F as SupabaseClaims, I as SupabaseClaimsOptions, L as SupabaseClaimsSchema, M as SupabaseSuspendedScope, N as SupabaseSuspension, O as SupabaseSessionLike, P as SupabaseActClaim, R as SupabaseMembershipClaim, S as SupabasePermissionRef, T as SupabaseRlsConfig, _ as SupabaseActor, a as MembershipStream, b as SupabaseInclude, c as SupabasePostgres, d as supabasePostgresQuery, f as tableMembershipSource, g as SupabaseActiveRow, h as RoleThrough, i as MembershipSql, j as SupabaseSuspendedMembership, k as SupabaseStorage, l as authzVersion, n as MembershipHolders, o as MembershipTableOptions, p as AuthorizeSqlOptions, r as MembershipJunctionOptions, s as SqlMembershipSource, t as AUTHZ_VERSION_TABLE, u as junctionMembershipSource, v as SupabaseActorResult, w as SupabaseRealtime, x as SupabaseMembershipTable, y as SupabaseDelegation, z as SupabasePermDockClaims } from "../sources-oB1Hg1Fm.js";
+import { Kt as Instant, yr as Subject } from "../policy-types-IRJVABmm.js";
+import { i as ApprovalPolicySource } from "../approval-policies-9VagPixq.js";
+import { a as ApprovalDelegationSource, m as ApprovalStore, u as ApprovalRequest } from "../types-BvBbkAu1.js";
+import { a as SupabaseRpcClient, c as readSubjectRecord, i as SupabaseRpcCaller, n as PostgrestSourcesOptions, o as SupabaseRpcResult, r as SubjectRecord, s as postgrestSources, t as PostgrestSources } from "../postgrest-B_cEDd4e.js";
+import { A as SupabaseSubjectOptions, B as supabaseClaims, C as SupabasePrincipal, D as SupabaseRlsOptions, E as SupabaseRlsMembershipTable, F as SupabaseClaims, I as SupabaseClaimsOptions, L as SupabaseClaimsSchema, M as SupabaseSuspendedScope, N as SupabaseSuspension, O as SupabaseSessionLike, P as SupabaseActClaim, R as SupabaseMembershipClaim, S as SupabasePermissionRef, T as SupabaseRlsConfig, _ as SupabaseActor, a as MembershipStream, b as SupabaseInclude, c as SupabasePostgres, d as supabasePostgresQuery, f as tableMembershipSource, g as SupabaseActiveRow, h as RoleThrough, i as MembershipSql, j as SupabaseSuspendedMembership, k as SupabaseStorage, l as authzVersion, n as MembershipHolders, o as MembershipTableOptions, p as AuthorizeSqlOptions, r as MembershipJunctionOptions, s as SqlMembershipSource, t as AUTHZ_VERSION_TABLE, u as junctionMembershipSource, v as SupabaseActorResult, w as SupabaseRealtime, x as SupabaseMembershipTable, y as SupabaseDelegation, z as SupabasePermDockClaims } from "../sources-CXY05xtB.js";
 import { _ as hasTokenHook, a as SupabaseManifestActiveRow, c as SupabaseManifestMembership, d as SupabaseManifestResourceNames, f as SupabaseManifestRls, g as SupabaseManifestValue, h as SupabaseManifestThrough, i as SupabaseManifest, l as SupabaseManifestNames, m as SupabaseManifestScopeNames, n as SupabaseHookClaim, o as SupabaseManifestColumn, p as SupabaseManifestRole, r as SupabaseHookManifest, s as SupabaseManifestHelper, t as SupabaseDatabaseManifest, u as SupabaseManifestRequires, v as parseSupabaseManifest } from "../manifest-B5yF3CIq.js";
 import { t as SqlQuery } from "../sql-B80DFdpG.js";
-import { n as supabaseTenantClaim, t as supabaseMembershipsBudget } from "../budget-hYsPz_yE.js";
+import { n as supabaseTenantClaim, t as supabaseMembershipsBudget } from "../budget-CNLsV2SL.js";
+//#region src/supabase/authz-topic.d.ts
+/**
+ * The server topic the generated version trigger broadcasts on without
+ * better-supabase; no user may join it. With better-supabase it is
+ * `better_supabase:authz`.
+ */
+export declare const AUTHZ_TOPIC = "permdock:authz";
+/** The broadcast event of a version bump, as better-supabase names it. */
+export declare const AUTHZ_EVENT = "changed";
+/** The private topic one user receives their own version bumps on. */
+export declare function authzUserTopic(userId: string): string;
+//#endregion
 //#region src/supabase/capability.d.ts
 type ExchangeCapabilityOptions = {
   /**
@@ -66,6 +79,24 @@ type SupabaseApprovalStoreOptions = {
  */
 export declare function supabaseApprovalStore(client: SupabaseRpcCaller, options?: SupabaseApprovalStoreOptions): ApprovalStore;
 //#endregion
+//#region src/supabase/approval-policies.d.ts
+type TableApprovalPolicySourceOptions = {
+  readonly query: SqlQuery;
+  /**
+   * The schema holding `permdock_approval_policies_for`. Defaults to
+   * `permdock`, where `rls.approvals.tenantPolicies` writes it.
+   */
+  readonly schema?: string;
+};
+/**
+ * Approval policies from the table `rls.approvals.tenantPolicies` generates:
+ * the subject's tenants' enabled rows and every platform floor. A row whose
+ * body is not an object throws, and the evaluator checks every entry with
+ * `validateApprovalPolicy`, so a bad row denies every call an allow would grant
+ * until it is fixed.
+ */
+export declare function tableApprovalPolicySource(options: TableApprovalPolicySourceOptions): ApprovalPolicySource;
+//#endregion
 //#region src/supabase/approval-delegations.d.ts
 type TableApprovalDelegationSourceOptions = {
   readonly query: SqlQuery;
@@ -126,4 +157,4 @@ export declare function subjectFromSupabase(claims: unknown, options?: SupabaseS
  */
 export declare function subjectFromSupabaseSession(session: SupabaseSessionLike | null | undefined, options?: SupabaseSubjectOptions): Subject<SupabasePrincipal>;
 //#endregion
-export { AUTHZ_VERSION_TABLE, type AuthorizeSqlOptions, type ExchangeCapabilityOptions, type MembershipHolders, type MembershipJunctionOptions, type MembershipSql, type MembershipStream, type MembershipTableOptions, type PostgrestSources, type PostgrestSourcesOptions, type RoleThrough, type SqlMembershipSource, type SqlQuery, type SubjectRecord, type SupabaseActClaim, type SupabaseActiveRow, type SupabaseActor, type SupabaseActorResult, type SupabaseApprovalStoreOptions, type SupabaseClaims, type SupabaseClaimsOptions, type SupabaseClaimsSchema, type SupabaseDatabaseManifest, type SupabaseDelegation, type SupabaseHookClaim, type SupabaseHookManifest, type SupabaseInclude, type SupabaseManifest, type SupabaseManifestActiveRow, type SupabaseManifestColumn, type SupabaseManifestHelper, type SupabaseManifestMembership, type SupabaseManifestNames, type SupabaseManifestRequires, type SupabaseManifestResourceNames, type SupabaseManifestRls, type SupabaseManifestRole, type SupabaseManifestScopeNames, type SupabaseManifestThrough, type SupabaseManifestValue, type SupabaseMembershipClaim, type SupabaseMembershipTable, type SupabasePermDockClaims, type SupabasePermissionRef, type SupabasePostgres, type SupabasePrincipal, type SupabaseRealtime, type SupabaseRlsConfig, type SupabaseRlsMembershipTable, type SupabaseRlsOptions, type SupabaseRpcCaller, type SupabaseRpcClient, type SupabaseRpcResult, type SupabaseSessionLike, type SupabaseStorage, type SupabaseSubjectOptions, type SupabaseSuspendedMembership, type SupabaseSuspendedScope, type SupabaseSuspension, type TableApprovalDelegationSourceOptions, authzVersion, hasTokenHook, junctionMembershipSource, parseSupabaseManifest, postgrestSources, readSubjectRecord, supabaseClaims, supabaseMembershipsBudget, supabasePostgresQuery, supabaseTenantClaim, tableMembershipSource };
+export { AUTHZ_VERSION_TABLE, type AuthorizeSqlOptions, type ExchangeCapabilityOptions, type MembershipHolders, type MembershipJunctionOptions, type MembershipSql, type MembershipStream, type MembershipTableOptions, type PostgrestSources, type PostgrestSourcesOptions, type RoleThrough, type SqlMembershipSource, type SqlQuery, type SubjectRecord, type SupabaseActClaim, type SupabaseActiveRow, type SupabaseActor, type SupabaseActorResult, type SupabaseApprovalStoreOptions, type SupabaseClaims, type SupabaseClaimsOptions, type SupabaseClaimsSchema, type SupabaseDatabaseManifest, type SupabaseDelegation, type SupabaseHookClaim, type SupabaseHookManifest, type SupabaseInclude, type SupabaseManifest, type SupabaseManifestActiveRow, type SupabaseManifestColumn, type SupabaseManifestHelper, type SupabaseManifestMembership, type SupabaseManifestNames, type SupabaseManifestRequires, type SupabaseManifestResourceNames, type SupabaseManifestRls, type SupabaseManifestRole, type SupabaseManifestScopeNames, type SupabaseManifestThrough, type SupabaseManifestValue, type SupabaseMembershipClaim, type SupabaseMembershipTable, type SupabasePermDockClaims, type SupabasePermissionRef, type SupabasePostgres, type SupabasePrincipal, type SupabaseRealtime, type SupabaseRlsConfig, type SupabaseRlsMembershipTable, type SupabaseRlsOptions, type SupabaseRpcCaller, type SupabaseRpcClient, type SupabaseRpcResult, type SupabaseSessionLike, type SupabaseStorage, type SupabaseSubjectOptions, type SupabaseSuspendedMembership, type SupabaseSuspendedScope, type SupabaseSuspension, type TableApprovalDelegationSourceOptions, type TableApprovalPolicySourceOptions, authzVersion, hasTokenHook, junctionMembershipSource, parseSupabaseManifest, postgrestSources, readSubjectRecord, supabaseClaims, supabaseMembershipsBudget, supabasePostgresQuery, supabaseTenantClaim, tableMembershipSource };