permdock 0.16.0 → 0.18.0

package/dist/{protected-action-QEA8arRB.js → protected-action-B40tU3yP.js}

@@ -1,8 +1,8 @@
-import { n as actionRunner, t as actionApproval } from "./protected-action-DUYqb-Ma.js";
-import { c as rolesView, d as subjectView, f as tenantView, i as gateView, l as scopedTenant, n as describeWith, o as permissionSet, r as filterResult, s as protectedView, t as approvalHandle, u as slotContent } from "./views-CD8wuL4Z.js";
-import { n as storeOf } from "./store-options-Dil3lraY.js";
+import { n as actionRunner, t as actionApproval } from "./protected-action-OpOxtTsN.js";
+import { c as rolesView, d as subjectView, f as tenantView, i as gateView, l as scopedTenant, n as describeWith, o as permissionSet, r as filterResult, s as protectedView, t as approvalHandle, u as slotContent } from "./views-MWmJ6Y4P.js";
+import { n as storeOf } from "./store-options--zWn48PK.js";
 import { a as PermDockUiContext, i as PermDockStoreContext, r as PermDockSnapshotPromiseContext } from "./live-options-BBIT68le.js";
-import { Suspense, use, useLayoutEffect, useMemo, useState, useSyncExternalStore } from "react";
+import { Suspense, use, useEffect, useLayoutEffect, useMemo, useState, useSyncExternalStore } from "react";
 import { jsx } from "react/jsx-runtime";
 //#region src/react/hooks.ts
 function useStore() {
@@ -16,6 +16,16 @@ function usePermDock() {
 	const store = useStore();
 	return useSyncExternalStore((listener) => store.subscribe(listener), () => store.get(), () => store.get());
 }
+/**
+* Adds refresh triggers to the nearest provider while the component is mounted.
+* Use it where the provider's own `refreshOn` cannot be set, such as below
+* `permdock/next`'s Server Component provider: functions cannot cross to the
+* client. Keep `triggers` stable (module scope); a new array resubscribes.
+*/
+function useRefreshOn(triggers) {
+	const store = useStore();
+	useEffect(() => store.refreshOn(triggers), [store, triggers]);
+}
 function usePermission(permission, data) {
 	const permdock = usePermDock();
 	return useMemo(() => storeOf(permdock).permissionState(permission, data), [
@@ -160,4 +170,4 @@ function useProtectedAction(action, permission, data, options = {}) {
 	]);
 }
 //#endregion
-export { useAssignableRoles as a, useGate as c, usePermission as d, usePermissions as f, useTenant as h, useAssignablePermissions as i, useMemberships as l, useSubject as m, Protected as n, useDescribe as o, useRoles as p, useApproval as r, useFilter as s, useProtectedAction as t, usePermDock as u };
+export { useAssignableRoles as a, useGate as c, usePermission as d, usePermissions as f, useTenant as g, useSubject as h, useAssignablePermissions as i, useMemberships as l, useRoles as m, Protected as n, useDescribe as o, useRefreshOn as p, useApproval as r, useFilter as s, useProtectedAction as t, usePermDock as u };

package/dist/{protected-action-D8x73IGm.d.ts → protected-action-Ds_EUY8B.d.ts}

@@ -1,14 +1,21 @@
-import { Un as Decision, fr as Membership, j as PolicyVocabulary } from "./policy-types-DGIO_gxq.js";
+import { M as PolicyVocabulary, gr as Membership, qn as Decision } from "./policy-types-D-GwfQTc.js";
 import { u as Permission } from "./permission-types-CAY-GU7e.js";
 import { r as Role } from "./vocabulary-DEJ5j4mR.js";
-import { d as UncheckedData, s as RowData } from "./permdock-CprAPN3w.js";
-import { r as DescribeOptions, t as DecisionDescription } from "./describe-BbFPBSms.js";
-import { n as ProtectedAction } from "./action-result-BcudBQOF.js";
-import { a as FilterResult, c as PermissionSet, h as TenantView, l as PermissionState, m as SubjectView, o as GateMode, p as RolesOptions, r as ClientPermDock, s as GateView, t as ApprovalHandle, u as ProtectedActionHandle } from "./types-tQB2CEnY.js";
-import { r as ProtectedProps } from "./types-rCRV4Ge-.js";
+import { d as UncheckedData, s as RowData } from "./permdock-ffY4CMd9.js";
+import { r as DescribeOptions, t as DecisionDescription } from "./describe-BKtC_8PG.js";
+import { _ as TenantView, a as ClientPermDock, c as GateMode, d as PermissionState, f as ProtectedActionHandle, g as SubjectView, h as RolesOptions, l as GateView, r as ApprovalHandle, s as FilterResult, u as PermissionSet, y as ProtectedAction } from "./store-DYeB-_U3.js";
+import { r as RefreshTrigger } from "./refresh-on-L9UOwATg.js";
+import { r as ProtectedProps } from "./types-DmbfLu2p.js";
 import { ReactNode } from "react";
 //#region src/react/hooks.d.ts
 declare function usePermDock<V extends PolicyVocabulary = PolicyVocabulary>(): ClientPermDock<V>;
+/**
+ * Adds refresh triggers to the nearest provider while the component is mounted.
+ * Use it where the provider's own `refreshOn` cannot be set, such as below
+ * `permdock/next`'s Server Component provider: functions cannot cross to the
+ * client. Keep `triggers` stable (module scope); a new array resubscribes.
+ */
+declare function useRefreshOn(triggers: readonly RefreshTrigger[]): void;
 declare function usePermission<D>(permission: Permission, data?: UncheckedData<D>): PermissionState;
 declare function usePermission<P extends Permission>(permission: P, data?: RowData<P>): PermissionState;
 declare function usePermissions(permissions: readonly Permission[], data?: unknown): PermissionSet;
@@ -55,4 +62,4 @@ declare function useProtectedAction<T, P extends Permission>(action: ProtectedAc
   readonly mode?: GateMode;
 }): ProtectedActionHandle<T>;
 //#endregion
-export { useAssignableRoles as a, useGate as c, usePermission as d, usePermissions as f, useTenant as h, useAssignablePermissions as i, useMemberships as l, useSubject as m, Protected as n, useDescribe as o, useRoles as p, useApproval as r, useFilter as s, useProtectedAction as t, usePermDock as u };
+export { useAssignableRoles as a, useGate as c, usePermission as d, usePermissions as f, useTenant as g, useSubject as h, useAssignablePermissions as i, useMemberships as l, useRoles as m, Protected as n, useDescribe as o, useRefreshOn as p, useApproval as r, useFilter as s, useProtectedAction as t, usePermDock as u };

package/dist/{protected-action-DUYqb-Ma.js → protected-action-OpOxtTsN.js}

@@ -1,6 +1,6 @@
 import { a as problemType } from "./problem-details-CLDgX1KV.js";
 import { t as approvalHeaderValue } from "./approval-header-8QV6MU4H.js";
-import { t as approvalHandle } from "./views-CD8wuL4Z.js";
+import { t as approvalHandle } from "./views-MWmJ6Y4P.js";
 //#region src/client/headers.ts
 /**
 * The `PermDock-Approval` header for a resume; a `TypeError` for a token that

package/dist/{provider-C55OGXJ7.js → provider-CY4TSSJo.js}

@@ -1,6 +1,6 @@
 import { t as compact } from "./compact-CAf557ZB.js";
-import { t as emptySnapshot } from "./from-snapshot-DCakWRsr.js";
-import { t as adapterStore } from "./store-options-Dil3lraY.js";
+import { t as emptySnapshot } from "./from-snapshot-DMlSSo9b.js";
+import { t as adapterStore } from "./store-options--zWn48PK.js";
 import { a as PermDockUiContext, i as PermDockStoreContext, n as useKeyed, r as PermDockSnapshotPromiseContext, t as useLiveOptions } from "./live-options-BBIT68le.js";
 import { useLayoutEffect, useMemo } from "react";
 import { jsx } from "react/jsx-runtime";

package/dist/{provider-DfLeek9O.d.ts → provider-OtnIiFWm.d.ts}

@@ -1,4 +1,4 @@
-import { n as PermDockProviderProps } from "./types-rCRV4Ge-.js";
+import { n as PermDockProviderProps } from "./types-DmbfLu2p.js";
 import { ReactElement } from "react";
 //#region src/react/provider.d.ts
 declare function PermDockProvider(props: PermDockProviderProps): ReactElement;

package/dist/{provider-store-CaTv00tr.js → provider-store-BQP_pp8s.js}

@@ -1,6 +1,6 @@
 import { t as compact } from "./compact-CAf557ZB.js";
-import { t as emptySnapshot } from "./from-snapshot-DCakWRsr.js";
-import { a as isPromiseLike, t as adapterStore } from "./store-options-Dil3lraY.js";
+import { t as emptySnapshot } from "./from-snapshot-DMlSSo9b.js";
+import { l as isPromiseLike, t as adapterStore } from "./store-options--zWn48PK.js";
 //#region src/client/provider-store.ts
 /**
 * Store options that read `read()` on every request, so a rotated token, a new

package/dist/{pull-CQCGy1gv.js → pull-DLP4I1Kl.js}

@@ -1,16 +1,16 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
 import { t as catalogFingerprint } from "./catalog-fingerprint-e6aCWosn.js";
-import { a as describeError } from "./errors-Vpu6rKHl.js";
+import { a as describeError } from "./errors-BhRkoNS7.js";
 import { s as writeFileEnsuringDir } from "./files-BSjrtIHw.js";
 import { s as cliVersion } from "./version-DMQ0dnN5.js";
-import { o as formatCatalogJson } from "./catalog-doc-DjMKzJp9.js";
+import { o as formatCatalogJson } from "./catalog-doc-C4DGfJCO.js";
 import { t as catalogPath } from "./catalog-path-CnI0XTFK.js";
-import { n as parseSupabaseManifest } from "./manifest-BXTbHNIV.js";
-import { t as parseCatalog } from "./parse-1_ZheTW5.js";
-import { a as nonEmptyOr } from "./output-DlICTjBh.js";
+import { n as parseSupabaseManifest } from "./manifest-BdzBobNK.js";
+import { t as parseCatalog } from "./parse-UTC-sDrt.js";
+import { a as nonEmptyOr } from "./output-BFWLER4r.js";
 import { t as POLICY_NOT_PUBLISHED } from "./problem-types-DSsRfONQ.js";
-import { n as httpRequest, t as authFailure } from "./http-DOL33cO0.js";
-import { l as cloudUrl, n as cliRuntime, o as readAuth } from "./auth--yPyZNgr.js";
+import { n as httpRequest, t as authFailure } from "./http-DhMWeB_h.js";
+import { l as cloudUrl, n as cliRuntime, o as readAuth } from "./auth-j3Eu-j4h.js";
 import { n as formatManifestJson } from "./manifest-json-CAGzls-C.js";
 import { existsSync, readFileSync, rmSync } from "node:fs";
 import { relative, resolve } from "node:path";

package/dist/pull-UBjDnf4b.js

@@ -0,0 +1 @@
+export { n as runCloudPull } from "./pull-DLP4I1Kl.js";

package/dist/{push-Dq_ca4-j.js → push-BSb8j1EW.js}

@@ -1,15 +1,15 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
 import { n as PermDockValidationError } from "./validation-error-CYg2kJEw.js";
 import { t as catalogFingerprint } from "./catalog-fingerprint-e6aCWosn.js";
-import { a as describeError, n as CliError } from "./errors-Vpu6rKHl.js";
+import { a as describeError, n as CliError } from "./errors-BhRkoNS7.js";
 import { s as cliVersion } from "./version-DMQ0dnN5.js";
-import { i as loadConfiguredPolicy } from "./load-DjSU5KXO.js";
-import { n as parseSupabaseManifest } from "./manifest-BXTbHNIV.js";
-import { t as parseCatalog } from "./parse-1_ZheTW5.js";
-import { r as pushedPolicy } from "./pushed-policy-CDuOL2de.js";
-import { n as runCatalog } from "./catalog-CGlSwU6j.js";
-import { n as httpRequest, t as authFailure } from "./http-DOL33cO0.js";
-import { a as pushAuth, l as cloudUrl, n as cliRuntime, u as firstNonEmpty } from "./auth--yPyZNgr.js";
+import { i as loadConfiguredPolicy } from "./load-BaEamml-.js";
+import { n as parseSupabaseManifest } from "./manifest-BdzBobNK.js";
+import { t as parseCatalog } from "./parse-UTC-sDrt.js";
+import { r as pushedPolicy } from "./pushed-policy-BecMsTtM.js";
+import { n as runCatalog } from "./catalog-D1fw8qif.js";
+import { n as httpRequest, t as authFailure } from "./http-DhMWeB_h.js";
+import { a as pushAuth, l as cloudUrl, n as cliRuntime, u as firstNonEmpty } from "./auth-j3Eu-j4h.js";
 import "./manifest-json-CAGzls-C.js";
 import { existsSync, readFileSync } from "node:fs";
 import { resolve } from "node:path";

package/dist/{pushed-policy-CDuOL2de.js → pushed-policy-BecMsTtM.js}

@@ -3,7 +3,7 @@ import { n as freezeDeep } from "./freeze-jjan0lCv.js";
 import { n as PermDockValidationError } from "./validation-error-CYg2kJEw.js";
 import { n as RFC3339_PATTERN } from "./time-nR1JesoH.js";
 import { i as wireValidity } from "./validity-Buc7w8E9.js";
-import { n as snapshotScopes } from "./instance-snapshot-DuWf1cT3.js";
+import { n as snapshotScopes } from "./instance-snapshot-BWa71my8.js";
 import { n as copyJson, r as forbiddenKeyPath, t as checkSchema } from "./json-schema-BPGa-RjQ.js";
 //#region src/catalog/pushed-policy.ts
 const strings = {

package/dist/{pushed-policy-CryQheKq.d.ts → pushed-policy-Ck3FZcoy.d.ts}

@@ -1,4 +1,4 @@
-import { An as Grantee, H as WireValidity, T as Policy, Vn as AppObligation, _ as GrantLimit, a as ApprovalRequirement, br as Condition, tn as SnapshotScope, u as BreakGlassSpec, v as GrantMeta } from "./policy-types-DGIO_gxq.js";
+import { E as Policy, Gn as AppObligation, Pn as Grantee, U as WireValidity, d as BreakGlassSpec, o as ApprovalRequirement, rn as SnapshotScope, v as GrantLimit, wr as Condition, y as GrantMeta } from "./policy-types-D-GwfQTc.js";
 import { t as JsonSchemaNode } from "./json-schema-BfXgnRNT.js";
 //#region src/catalog/pushed-policy.d.ts
 /**

package/dist/react/index.d.ts

@@ -1,9 +1,9 @@
-import { c as requiredPlans } from "../errors-BIM4MFsJ.js";
-import { i as describe } from "../describe-BbFPBSms.js";
-import { n as ProtectedAction, t as ActionResult } from "../action-result-BcudBQOF.js";
+import { c as requiredPlans } from "../errors-TpzkEKgJ.js";
+import { i as describe } from "../describe-BKtC_8PG.js";
+import { _ as TenantView, a as ClientPermDock, c as GateMode, d as PermissionState, f as ProtectedActionHandle, g as SubjectView, h as RolesOptions, i as ApprovalState, l as GateView, o as ClientStatus, p as ProtectedActionView, r as ApprovalHandle, s as FilterResult, u as PermissionSet, v as ActionResult, y as ProtectedAction } from "../store-DYeB-_U3.js";
+import { a as broadcastChannelRefresh, c as visibilityRefresh, i as authzChangeRefresh, n as EventSourceRefreshOptions, o as eventSourceRefresh, r as RefreshTrigger, s as focusRefresh, t as AuthzChangeRefresh } from "../refresh-on-L9UOwATg.js";
+import { n as PermDockProviderProps, r as ProtectedProps, t as PermDockDefaults } from "../types-DmbfLu2p.js";
 import { t as approvalHeaders } from "../headers-B9jQxjtW.js";
-import { a as FilterResult, b as eventSourceRefresh, c as PermissionSet, d as ProtectedActionView, h as TenantView, i as ClientStatus, l as PermissionState, m as SubjectView, n as ApprovalState, o as GateMode, p as RolesOptions, r as ClientPermDock, s as GateView, t as ApprovalHandle, u as ProtectedActionHandle, v as EventSourceRefreshOptions, y as RefreshTrigger } from "../types-tQB2CEnY.js";
-import { n as PermDockProviderProps, r as ProtectedProps, t as PermDockDefaults } from "../types-rCRV4Ge-.js";
-import { a as useAssignableRoles, c as useGate, d as usePermission, f as usePermissions, h as useTenant, i as useAssignablePermissions, l as useMemberships, m as useSubject, n as Protected, o as useDescribe, p as useRoles, r as useApproval, s as useFilter, t as useProtectedAction, u as usePermDock } from "../protected-action-D8x73IGm.js";
-import { t as PermDockProvider } from "../provider-DfLeek9O.js";
-export { type ActionResult, type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type EventSourceRefreshOptions, type FilterResult, type GateMode, type GateView, type PermDockDefaults, PermDockProvider, type PermDockProviderProps, type PermissionSet, type PermissionState, Protected, type ProtectedAction, type ProtectedActionHandle, type ProtectedActionView, type ProtectedProps, type RefreshTrigger, type RolesOptions, type SubjectView, type TenantView, approvalHeaders, describe, eventSourceRefresh, requiredPlans, useApproval, useAssignablePermissions, useAssignableRoles, useDescribe, useFilter, useGate, useMemberships, usePermDock, usePermission, usePermissions, useProtectedAction, useRoles, useSubject, useTenant };
+import { a as useAssignableRoles, c as useGate, d as usePermission, f as usePermissions, g as useTenant, h as useSubject, i as useAssignablePermissions, l as useMemberships, m as useRoles, n as Protected, o as useDescribe, p as useRefreshOn, r as useApproval, s as useFilter, t as useProtectedAction, u as usePermDock } from "../protected-action-Ds_EUY8B.js";
+import { t as PermDockProvider } from "../provider-OtnIiFWm.js";
+export { type ActionResult, type ApprovalHandle, type ApprovalState, type AuthzChangeRefresh, type ClientPermDock, type ClientStatus, type EventSourceRefreshOptions, type FilterResult, type GateMode, type GateView, type PermDockDefaults, PermDockProvider, type PermDockProviderProps, type PermissionSet, type PermissionState, Protected, type ProtectedAction, type ProtectedActionHandle, type ProtectedActionView, type ProtectedProps, type RefreshTrigger, type RolesOptions, type SubjectView, type TenantView, approvalHeaders, authzChangeRefresh, broadcastChannelRefresh, describe, eventSourceRefresh, focusRefresh, requiredPlans, useApproval, useAssignablePermissions, useAssignableRoles, useDescribe, useFilter, useGate, useMemberships, usePermDock, usePermission, usePermissions, useProtectedAction, useRefreshOn, useRoles, useSubject, useTenant, visibilityRefresh };

package/dist/react/index.js

@@ -1,8 +1,8 @@
 "use client";
 import { r as requiredPlans } from "../problem-details-CLDgX1KV.js";
-import { n as describe } from "../describe-Bb4hGK5d.js";
-import { r as approvalHeaders } from "../protected-action-DUYqb-Ma.js";
-import { r as eventSourceRefresh } from "../store-options-Dil3lraY.js";
-import { a as useAssignableRoles, c as useGate, d as usePermission, f as usePermissions, h as useTenant, i as useAssignablePermissions, l as useMemberships, m as useSubject, n as Protected, o as useDescribe, p as useRoles, r as useApproval, s as useFilter, t as useProtectedAction, u as usePermDock } from "../protected-action-QEA8arRB.js";
-import { t as PermDockProvider } from "../provider-C55OGXJ7.js";
-export { PermDockProvider, Protected, approvalHeaders, describe, eventSourceRefresh, requiredPlans, useApproval, useAssignablePermissions, useAssignableRoles, useDescribe, useFilter, useGate, useMemberships, usePermDock, usePermission, usePermissions, useProtectedAction, useRoles, useSubject, useTenant };
+import { n as describe } from "../describe-BZAlPHxT.js";
+import { r as approvalHeaders } from "../protected-action-OpOxtTsN.js";
+import { a as eventSourceRefresh, i as broadcastChannelRefresh, o as focusRefresh, r as authzChangeRefresh, s as visibilityRefresh } from "../store-options--zWn48PK.js";
+import { a as useAssignableRoles, c as useGate, d as usePermission, f as usePermissions, g as useTenant, h as useSubject, i as useAssignablePermissions, l as useMemberships, m as useRoles, n as Protected, o as useDescribe, p as useRefreshOn, r as useApproval, s as useFilter, t as useProtectedAction, u as usePermDock } from "../protected-action-B40tU3yP.js";
+import { t as PermDockProvider } from "../provider-CY4TSSJo.js";
+export { PermDockProvider, Protected, approvalHeaders, authzChangeRefresh, broadcastChannelRefresh, describe, eventSourceRefresh, focusRefresh, requiredPlans, useApproval, useAssignablePermissions, useAssignableRoles, useDescribe, useFilter, useGate, useMemberships, usePermDock, usePermission, usePermissions, useProtectedAction, useRefreshOn, useRoles, useSubject, useTenant, visibilityRefresh };

package/dist/react/provider-client.d.ts

@@ -1,2 +1,2 @@
-import { t as PermDockProvider } from "../provider-DfLeek9O.js";
+import { t as PermDockProvider } from "../provider-OtnIiFWm.js";
 export { PermDockProvider };

package/dist/react/provider-client.js

@@ -1,2 +1,2 @@
 "use client";
-export { t as PermDockProvider } from "../provider-C55OGXJ7.js";
+export { t as PermDockProvider } from "../provider-CY4TSSJo.js";

package/dist/react-native/index.d.ts

@@ -1,14 +1,15 @@
-import { Jt as LocalRowValue, Kt as LocalMembershipRows, Wt as Instant, Xt as LocalSnapshotRows, Yt as LocalSnapshotManifest, Zt as Snapshot, ct as SnapshotSource, fr as Membership, qt as LocalRowColumn, sr as CustomRole } from "../policy-types-DGIO_gxq.js";
+import { $t as Snapshot, Jt as LocalMembershipRows, Kt as Instant, Qt as LocalSnapshotRows, Xt as LocalRowValue, Yt as LocalRowColumn, Zt as LocalSnapshotManifest, dr as CustomRole, gr as Membership, lt as SnapshotSource } from "../policy-types-D-GwfQTc.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
-import { c as requiredPlans } from "../errors-BIM4MFsJ.js";
-import { i as describe } from "../describe-BbFPBSms.js";
-import { t as parseLocalSnapshotManifest } from "../parse-local-manifest-CCmbhnxP.js";
-import { n as ProtectedAction, t as ActionResult } from "../action-result-BcudBQOF.js";
+import { c as requiredPlans } from "../errors-TpzkEKgJ.js";
+import { i as describe } from "../describe-BKtC_8PG.js";
+import { t as parseLocalSnapshotManifest } from "../parse-local-manifest-DvjTQNuO.js";
+import { _ as TenantView, a as ClientPermDock, c as GateMode, d as PermissionState, f as ProtectedActionHandle, g as SubjectView, h as RolesOptions, i as ApprovalState, l as GateView, o as ClientStatus, p as ProtectedActionView, r as ApprovalHandle, s as FilterResult, t as ClientStore, u as PermissionSet, v as ActionResult, y as ProtectedAction } from "../store-DYeB-_U3.js";
+import { i as authzChangeRefresh, n as EventSourceRefreshOptions, o as eventSourceRefresh, r as RefreshTrigger, t as AuthzChangeRefresh } from "../refresh-on-L9UOwATg.js";
+import { r as ProtectedProps, t as PermDockDefaults } from "../types-DmbfLu2p.js";
 import { t as approvalHeaders } from "../headers-B9jQxjtW.js";
-import { a as FilterResult, b as eventSourceRefresh, c as PermissionSet, d as ProtectedActionView, g as ClientStore, h as TenantView, i as ClientStatus, l as PermissionState, m as SubjectView, n as ApprovalState, o as GateMode, p as RolesOptions, r as ClientPermDock, s as GateView, t as ApprovalHandle, u as ProtectedActionHandle, v as EventSourceRefreshOptions, y as RefreshTrigger } from "../types-tQB2CEnY.js";
-import { r as ProtectedProps, t as PermDockDefaults } from "../types-rCRV4Ge-.js";
-import { a as useAssignableRoles, c as useGate, d as usePermission, f as usePermissions, h as useTenant, i as useAssignablePermissions, l as useMemberships, m as useSubject, n as Protected, o as useDescribe, p as useRoles, r as useApproval, s as useFilter, t as useProtectedAction, u as usePermDock } from "../protected-action-D8x73IGm.js";
-import { a as SubscribeOnline, i as SubscribeForeground, n as ReactNativePermDockProviderProps, r as SnapshotStorage, t as NativeRevalidate } from "../types-CWBsAwqn.js";
+import { a as useAssignableRoles, c as useGate, d as usePermission, f as usePermissions, g as useTenant, h as useSubject, i as useAssignablePermissions, l as useMemberships, m as useRoles, n as Protected, o as useDescribe, r as useApproval, s as useFilter, t as useProtectedAction, u as usePermDock } from "../protected-action-Ds_EUY8B.js";
+import { n as RealtimeRefreshClient, t as RealtimeRefreshChannel } from "../client-CH7vzSAY.js";
+import { a as SubscribeOnline, i as SubscribeForeground, n as ReactNativePermDockProviderProps, r as SnapshotStorage, t as NativeRevalidate } from "../types-o1vu6Ks3.js";
 import { ReactElement } from "react";
 //#region src/react-native/guards.d.ts
 /**
@@ -42,6 +43,11 @@ type LocalSnapshotData = {
   } | null;
   /** The tenant's custom roles, in the shape a `CustomRoleSource` returns. */
   readonly customRoles?: readonly CustomRole[];
+  /**
+   * The user's synced authorization version, set as `Snapshot.authzVersion`.
+   * Anything but a non-negative safe integer is ignored.
+   */
+  readonly authzVersion?: number;
 };
 type LocalSnapshotOptions = {
   /** `localSnapshotManifest(policy)`, written at build time. */
@@ -138,6 +144,94 @@ type PowerSyncSourceCache = {
  */
 export declare function powerSyncSourceCache(db: PowerSyncWatchable): PowerSyncSourceCache;
 //#endregion
+//#region src/react-native/subscriptions.d.ts
+/** The `AppState` export of `react-native`, as `appStateForeground` calls it. */
+type AppStateModule = {
+  addEventListener: (type: "change", listener: (state: string) => void) => {
+    remove: () => void;
+  };
+};
+/**
+ * The default export of `@react-native-community/netinfo`, as `netInfoOnline`
+ * calls it.
+ */
+type NetInfoModule = {
+  addEventListener: (listener: (state: {
+    readonly isConnected: boolean | null;
+    readonly isInternetReachable?: boolean | null;
+  }) => void) => () => void;
+};
+/**
+ * `subscribeForeground` over `AppState`: `active` returns to the foreground and
+ * `background` leaves it. iOS `inactive` (a system sheet over the app) is
+ * neither.
+ */
+export declare function appStateForeground(appState: AppStateModule): SubscribeForeground;
+/**
+ * `subscribeOnline` over NetInfo. An unknown (`null`) connection counts as
+ * online.
+ */
+export declare function netInfoOnline(netInfo: NetInfoModule): SubscribeOnline;
+//#endregion
+//#region src/react-native/native-refresh.d.ts
+/** The part of a supabase-js session `nativeRefresh` reads. */
+type NativeRefreshSession = {
+  readonly access_token: string;
+  readonly user: {
+    readonly id: string;
+  };
+};
+/** The part of a React Native supabase-js client `nativeRefresh` uses. */
+type NativeRefreshSupabase<C extends RealtimeRefreshChannel = RealtimeRefreshChannel> = RealtimeRefreshClient<C> & {
+  readonly auth: {
+    readonly getSession: () => Promise<{
+      readonly data: {
+        readonly session: NativeRefreshSession | null;
+      };
+    }>;
+    readonly refreshSession: () => Promise<unknown>;
+  };
+};
+/** The `PowerSyncDatabase` methods `nativeRefresh` calls. */
+type NativeRefreshDatabase<K> = PowerSyncWatchable & {
+  readonly connect: (connector: K) => Promise<void>;
+  readonly disconnect: () => Promise<void>;
+};
+type NativeRefreshPowerSync<K> = {
+  readonly db: NativeRefreshDatabase<K>;
+  /** The connector the app connects with; a reconnect fetches a new token. */
+  readonly connector: K;
+  /**
+   * The manifest `permdock powersync generate` writes. With its `rows.version`,
+   * a synced version above the token's `authz_ver` runs a refresh, which covers
+   * a message sent while the app was closed.
+   */
+  readonly manifest?: LocalSnapshotManifest;
+};
+type NativeRefreshOptions<C extends RealtimeRefreshChannel = RealtimeRefreshChannel, K = unknown> = {
+  readonly supabase: NativeRefreshSupabase<C>;
+  /** The `AppState` export of `react-native`. */
+  readonly appState: AppStateModule;
+  /**
+   * The default export of `@react-native-community/netinfo`. A signal that
+   * arrives offline waits for the connection, then runs once.
+   */
+  readonly netInfo?: NetInfoModule;
+  /** Reconnects PowerSync after the session refresh. */
+  readonly powersync?: NativeRefreshPowerSync<K>;
+};
+/**
+ * A `refreshOn` trigger for an Expo app on Supabase: on each message on the
+ * user's private `authz:<uid>` topic it refreshes the Supabase session, then
+ * reconnects PowerSync so streams that read token claims see the new ones, then
+ * refreshes the snapshot. Passes run one at a time; signals during a pass fold
+ * into one more. The channel closes in the background and rejoins on
+ * foreground, where one catch-up pass runs: a version check with
+ * `powersync.manifest`, else a full pass. It never imports `@supabase/*` or
+ * `@powersync/*`.
+ */
+export declare function nativeRefresh<C extends RealtimeRefreshChannel, K = unknown>(options: NativeRefreshOptions<C, K>): RefreshTrigger;
+//#endregion
 //#region src/react-native/provider.d.ts
 export declare function PermDockProvider(props: ReactNativePermDockProviderProps): ReactElement;
 //#endregion
@@ -175,35 +269,6 @@ export declare function secureStoreStorage(store: SecureStoreModule, options?: o
  */
 export declare function mmkvStorage(mmkv: MmkvInstance): SnapshotStorage;
 //#endregion
-//#region src/react-native/subscriptions.d.ts
-/** The `AppState` export of `react-native`, as `appStateForeground` calls it. */
-type AppStateModule = {
-  addEventListener: (type: "change", listener: (state: string) => void) => {
-    remove: () => void;
-  };
-};
-/**
- * The default export of `@react-native-community/netinfo`, as `netInfoOnline`
- * calls it.
- */
-type NetInfoModule = {
-  addEventListener: (listener: (state: {
-    readonly isConnected: boolean | null;
-    readonly isInternetReachable?: boolean | null;
-  }) => void) => () => void;
-};
-/**
- * `subscribeForeground` over `AppState`: `active` returns to the foreground and
- * `background` leaves it. iOS `inactive` (a system sheet over the app) is
- * neither.
- */
-export declare function appStateForeground(appState: AppStateModule): SubscribeForeground;
-/**
- * `subscribeOnline` over NetInfo. An unknown (`null`) connection counts as
- * online.
- */
-export declare function netInfoOnline(netInfo: NetInfoModule): SubscribeOnline;
-//#endregion
 //#region src/react-native/store.d.ts
 type NativeStoreOptions = Omit<ReactNativePermDockProviderProps, "children" | "headers" | "defaults" | "messages"> & {
   readonly headers?: Readonly<Record<string, string>> | (() => Readonly<Record<string, string>> | undefined);
@@ -222,4 +287,4 @@ type NativeStoreOptions = Omit<ReactNativePermDockProviderProps, "children" | "h
 export declare function connectSource(store: ClientStore, source: SnapshotSource, subscribeForeground?: SubscribeForeground): () => void;
 export declare function nativeStore(options: NativeStoreOptions): ClientStore;
 //#endregion
-export { type ActionResult, type AppStateModule, type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type EventSourceRefreshOptions, type FilterResult, type GateMode, type GateView, type LocalMembershipRows, type LocalRowColumn, type LocalRowValue, type LocalSnapshotData, type LocalSnapshotManifest, type LocalSnapshotOptions, type LocalSnapshotRows, type MmkvInstance, type NativeRevalidate, type NetInfoModule, type PermDockDefaults, type PermissionSet, type PermissionState, type PowerSyncQuery, type PowerSyncSourceCache, type PowerSyncSourceOptions, type PowerSyncWatchable, Protected, type ProtectedAction, type ProtectedActionHandle, type ProtectedActionView, type ProtectedProps, type ReactNativePermDockProviderProps, type RefreshTrigger, type RolesOptions, type SecureStoreModule, type SnapshotSource, type SnapshotStorage, type SubjectView, type SubscribeForeground, type SubscribeOnline, type TenantView, approvalHeaders, describe, eventSourceRefresh, parseLocalSnapshotManifest, requiredPlans, useApproval, useAssignablePermissions, useAssignableRoles, useDescribe, useFilter, useGate, useMemberships, usePermDock, usePermission, usePermissions, useProtectedAction, useRoles, useSubject, useTenant };
+export { type ActionResult, type AppStateModule, type ApprovalHandle, type ApprovalState, type AuthzChangeRefresh, type ClientPermDock, type ClientStatus, type EventSourceRefreshOptions, type FilterResult, type GateMode, type GateView, type LocalMembershipRows, type LocalRowColumn, type LocalRowValue, type LocalSnapshotData, type LocalSnapshotManifest, type LocalSnapshotOptions, type LocalSnapshotRows, type MmkvInstance, type NativeRefreshDatabase, type NativeRefreshOptions, type NativeRefreshPowerSync, type NativeRefreshSession, type NativeRefreshSupabase, type NativeRevalidate, type NetInfoModule, type PermDockDefaults, type PermissionSet, type PermissionState, type PowerSyncQuery, type PowerSyncSourceCache, type PowerSyncSourceOptions, type PowerSyncWatchable, Protected, type ProtectedAction, type ProtectedActionHandle, type ProtectedActionView, type ProtectedProps, type ReactNativePermDockProviderProps, type RefreshTrigger, type RolesOptions, type SecureStoreModule, type SnapshotSource, type SnapshotStorage, type SubjectView, type SubscribeForeground, type SubscribeOnline, type TenantView, approvalHeaders, authzChangeRefresh, describe, eventSourceRefresh, parseLocalSnapshotManifest, requiredPlans, useApproval, useAssignablePermissions, useAssignableRoles, useDescribe, useFilter, useGate, useMemberships, usePermDock, usePermission, usePermissions, useProtectedAction, useRoles, useSubject, useTenant };