permdock 0.17.0 → 0.18.0

package/dist/{powersync-C0nsyULQ.js → powersync-9PYOE1wt.js}

@@ -1,26 +1,59 @@
 import { r as isRecord, t as compact } from "./compact-CAf557ZB.js";
 import { c as isConditionDate, l as isConditionRef, o as hasConditionOp } from "./refs-C8BKxc_e.js";
-import { M as memoryCustomRoleSource, g as localSnapshotManifest } from "./src-nYNBfmgq.js";
+import { A as memoryCustomRoleSource, g as localSnapshotManifest } from "./src-Brzq_0in.js";
 import { n as findPermission } from "./permission-registry-B8tYxPIt.js";
 import { d as scopeList, s as resolveScope } from "./scopes-BSdYaGHs.js";
-import { l as policyLevels } from "./policy-DxQyHKPB.js";
+import { l as policyLevels } from "./policy-cV_wwPb8.js";
 import { t as requiresApproval } from "./approval-required-TzNB9oQA.js";
-import { t as getPermDock } from "./permdock-DdzMv5-F.js";
+import { t as getPermDock } from "./permdock-D-_WrdKu.js";
 import { u as usageResult } from "./errors-BhRkoNS7.js";
 import { c as requirePolicy } from "./load-BaEamml-.js";
 import { s as quoteSqlLiteral, t as SQL_IDENT } from "./sql-0WjxIp9g.js";
 import { a as scopeMembershipTable, i as scopeColumn } from "./compile-B_oJqmIg.js";
-import { d as keptKeys } from "./sources-C4vkzZJV.js";
+import { d as keptKeys, t as AUTHZ_VERSION_TABLE } from "./sources-C4vkzZJV.js";
 import { t as applyFiles } from "./files-CfiRtQ-m.js";
 import { i as fileDrift } from "./output-files-CM0BnH05.js";
-import { n as fixtureSubject, r as loadFixtures, t as fixtureRow } from "./fixtures-0VTW5oNq.js";
+import { n as fixtureSubject, r as loadFixtures, t as fixtureRow } from "./fixtures-Cemqurt8.js";
 import { A as quoteQualified, O as quoteIdent, a as customRolesOn, t as CUSTOM_ROLES } from "./shared-DyYVEjKC.js";
-import { n as tableNameOf, r as tableNames } from "./tables-BsGE6HBR.js";
-import { d as andConditions, l as collectGrants, o as assignableRoles, p as contextRefs, t as ownershipRules, u as roleNames } from "./ownership-moSRhxl_.js";
+import { n as tableNameOf, r as tableNames } from "./tables-BfOk0ymL.js";
+import { d as andConditions, l as collectGrants, o as assignableRoles, p as contextRefs, t as ownershipRules, u as roleNames } from "./ownership-D-mIt-w0.js";
 import { t as membershipSourcesOf } from "./sources-qoIJQrJv.js";
 import { n as pgConnector } from "./pg-Ddxsd5ZB.js";
-import { m as tableFor, t as canFixture } from "./verify-C8G8D5mk.js";
+import { m as tableFor, t as canFixture } from "./verify-Bpj0hauG.js";
 import { resolve } from "node:path";
+//#region src/cli/powersync/claims.ts
+/** The `/docs` section that explains why a claim stream needs a reconnect. */
+const RECONNECT_DOCS = "/docs/adapters/react-native#role-and-tenant-changes";
+/** A dialect that records every claim name a query reads. */
+function claimRecorder(dialect) {
+	const names = /* @__PURE__ */ new Set();
+	return {
+		names,
+		dialect: {
+			...dialect,
+			claim: (name) => {
+				names.add(name);
+				return dialect.claim(name);
+			},
+			claims: (name) => {
+				names.add(name);
+				return dialect.claims(name);
+			}
+		}
+	};
+}
+/** The recorded claims the kept queries still read, sorted. */
+function claimsIn(queries, names, dialect) {
+	return [...names].filter((name) => queries.some((query) => query.includes(dialect.claim(name)) || query.includes(dialect.claims(name)))).toSorted();
+}
+/**
+* One line per stream that reads a token claim: PowerSync keeps the claims a
+* connection started with, so a changed claim needs a reconnect.
+*/
+function claimWarnings(streams) {
+	return streams.filter((stream) => stream.claims.length > 0).map((stream) => `stream ${stream.name} reads token claims ${stream.claims.join(", ")}: PowerSync keeps the claims it connected with, so refresh the session and reconnect after a role or tenant change (${RECONNECT_DOCS})`);
+}
+//#endregion
 //#region src/cli/powersync/names.ts
 function ident(name) {
 	if (!SQL_IDENT.test(name)) throw new TypeError(`PermDock CLI: '${name}' is not a plain identifier, which Sync Streams need`);
@@ -217,6 +250,21 @@ function roleTableRows(stream, dialect, keep = false) {
 	});
 }
 //#endregion
+//#region src/cli/powersync/version.ts
+/** The user column of `permdock_authz_version`. */
+const VERSION_USER = "user_id";
+/** The version column of `permdock_authz_version`. */
+const VERSION_COLUMN = "version";
+/**
+* `<schema>.permdock_authz_version` when `supabase.hook` keeps the version
+* table, the one `supabase hook generate` writes; otherwise `undefined`.
+*/
+function authzVersionTable(config) {
+	const hook = config.supabase?.hook;
+	if (hook === void 0 || hook.version === false) return;
+	return `${hook.schema ?? config.rls?.schema ?? "permdock"}.${AUTHZ_VERSION_TABLE}`;
+}
+//#endregion
 //#region src/cli/powersync/rows.ts
 function throughColumn(through, device) {
 	const [pair] = Object.entries(through.on);
@@ -298,7 +346,13 @@ function localRows(policy, config, devices) {
 	const schema = rls?.schema ?? "permdock";
 	const database = rls?.authorize === "database";
 	const global = rls?.roles ?? (database ? { table: `${schema}.user_roles` } : void 0);
+	const versionTable = authzVersionTable(config);
 	return compact({
+		version: versionTable === void 0 ? void 0 : {
+			table: device(versionTable),
+			user: VERSION_USER,
+			version: VERSION_COLUMN
+		},
 		memberships,
 		roles: global === void 0 ? void 0 : {
 			table: device(global.table),
@@ -846,6 +900,11 @@ function subjectStreams(ctx) {
 			for (const ids of tenantIds) add(table, `SELECT * FROM ${from} WHERE ${tenant} IN (${ids})`);
 		}
 	}
+	const versionTable = authzVersionTable(ctx.config);
+	if (versionTable !== void 0) {
+		const table = bare(versionTable, dialect);
+		add(table, `SELECT * FROM ${fromTable(versionTable, dialect)} WHERE ${dialect.column(table, VERSION_USER)} = ${dialect.user}`, VERSION_USER);
+	}
 	const out = [];
 	const names = /* @__PURE__ */ new Set();
 	for (const [table, entry] of tables) {
@@ -916,13 +975,14 @@ function powersyncPlan(policy, config, dialect = POWERSYNC) {
 }
 function planWith(policy, config, dialect) {
 	const scopes = scopeList(policy.scopes);
+	const recorder = claimRecorder(dialect);
 	const grants = collectGrants(policy);
 	const ctx = {
 		policy,
 		config,
 		scopes,
 		kinds: ownershipRules(policy, scopes)?.kinds ?? {},
-		dialect,
+		dialect: recorder.dialect,
 		sources: guardedSources(policy, config),
 		grants,
 		depth: 0,
@@ -1006,7 +1066,8 @@ function planWith(policy, config, dialect) {
 			resource,
 			table,
 			id,
-			queries: [...queries]
+			queries: [...queries],
+			claims: claimsIn([...queries], recorder.names, dialect)
 		});
 	}
 	const tables = tableStreams(config.powersync?.tables ?? {}, dialect, new Set(streams.map((stream) => stream.name)), (resource) => ({
@@ -1034,6 +1095,60 @@ function planWith(policy, config, dialect) {
 	};
 }
 //#endregion
+//#region src/cli/powersync/verify-claims.ts
+function text(row, key) {
+	const value = isRecord(row) ? row[key] : void 0;
+	return typeof value === "string" || typeof value === "number" || typeof value === "bigint" ? String(value) : void 0;
+}
+function changedClaims(fixture) {
+	const before = fixture.subject.claims ?? {};
+	const after = fixture.after.claims ?? before;
+	return new Set([...Object.keys(before), ...Object.keys(after)].filter((name) => JSON.stringify(before[name]) !== JSON.stringify(after[name])));
+}
+/** The rows the stream syncs to the user with these claims, by id. */
+async function rowsFor(query, stream, user, claims) {
+	const rows = /* @__PURE__ */ new Map();
+	for (const sql of stream.queries) for (const row of await query(`select q.* from (${sql}) q where $1::text is not null and $2::jsonb is not null`, [user, JSON.stringify(claims)])) {
+		const id = text(row, stream.id);
+		if (id !== void 0) rows.set(id, row);
+	}
+	return rows;
+}
+/**
+* Check a claims change against every stream that reads a changed claim, or the
+* fixture's `stream`.
+*/
+async function verifyClaimsChange(input) {
+	const { fixture, plan, mismatches } = input;
+	const label = `claims change for ${fixture.subject.id}`;
+	const changed = changedClaims(fixture);
+	const streams = fixture.stream === void 0 ? plan.streams.filter((stream) => stream.claims.some((name) => changed.has(name))) : plan.streams.filter((stream) => stream.name === fixture.stream);
+	if (streams.length === 0) {
+		mismatches.push(fixture.stream === void 0 ? `${label}: no stream reads a changed claim` : `${label}: no stream named ${fixture.stream}`);
+		return;
+	}
+	const action = input.config.powersync?.action ?? "read";
+	const subject = {
+		...fixture.subject,
+		...fixture.after
+	};
+	for (const stream of streams) {
+		const before = await rowsFor(input.query, stream, fixture.subject.id, fixture.subject.claims ?? {});
+		const after = await rowsFor(input.query, stream, fixture.subject.id, subject.claims ?? {});
+		if (before.size === after.size && [...before.keys()].every((id) => after.has(id))) mismatches.push(`${label}: stream ${stream.name} syncs the same rows before and after the change`);
+		const permission = findPermission(input.policy.permissions, `${stream.resource}.${action}`);
+		if (permission === void 0) continue;
+		for (const [id, row] of after) {
+			const tenant = input.root === void 0 ? void 0 : text(row, input.root);
+			const permdock = await getPermDock(input.policy, fixtureSubject({
+				...subject,
+				...tenant === void 0 ? {} : { tenant }
+			}), { customRoles: memoryCustomRoleSource(input.customRoles) });
+			if (!canFixture(permdock, permission, row)) mismatches.push(`${label}: stream ${stream.name} syncs ${stream.table} row ${id} after the change, which the policy denies`);
+		}
+	}
+}
+//#endregion
 //#region src/cli/powersync/verify-followed.ts
 /** Check a non-resource row against its own-user rule or readable parents. */
 async function verifyFollowedRow(input) {
@@ -1074,7 +1189,8 @@ async function verifyFollowedRow(input) {
 	const holds = await input.synced({
 		...stream,
 		resource: fixture.table,
-		id: "id"
+		id: "id",
+		claims: []
 	}, fixture);
 	if (holds === void 0) mismatches.push(`${label}: fixture row needs id`);
 	else if (holds && !granted) mismatches.push(`${label}: stream ${stream.name} syncs a row the policy denies`);
@@ -1120,6 +1236,12 @@ function powersyncYaml(plan) {
 	const lines = [
 		"# Generated by permdock powersync generate from the policy. Do not edit.",
 		...plan.publication === void 0 ? [] : ["# Tables outside public must be in the powersync publication:", `# ${plan.publication}`],
+		...plan.streams.some((stream) => stream.claims.length > 0) ? [
+			"# Streams that read token claims keep the claims a connection started with:",
+			"# refresh the session and reconnect PowerSync after a role or tenant change.",
+			`# https://permdock.com${RECONNECT_DOCS}`,
+			...plan.streams.filter((stream) => stream.claims.length > 0).map((stream) => `#   ${stream.name} reads ${stream.claims.join(", ")}`)
+		] : [],
 		"config:",
 		"  edition: 3",
 		"",
@@ -1175,6 +1297,7 @@ function powersyncFiles(policy, config, out) {
 	return {
 		files,
 		warnings: plan.warnings,
+		claims: claimWarnings(plan.streams),
 		...plan.publication === void 0 ? {} : { publication: plan.publication }
 	};
 }
@@ -1235,6 +1358,19 @@ async function verifyStreams(input) {
 			for (const stream of [...plan.subject, ...plan.tables]) if (stream.user !== void 0 && await leaks(query, stream, stream.user, fixture)) mismatches.push(`stream ${stream.name} syncs another user's ${stream.table} rows to ${fixture.subject.id}`);
 		}
 		for (const fixture of input.fixtures) {
+			if ("after" in fixture) {
+				await verifyClaimsChange({
+					policy: input.policy,
+					config: input.config,
+					customRoles: input.customRoles,
+					plan,
+					fixture,
+					root,
+					query,
+					mismatches
+				});
+				continue;
+			}
 			if ("table" in fixture) {
 				await verifyFollowedRow({
 					policy: input.policy,
@@ -1320,12 +1456,13 @@ async function runPowerSync(input) {
 			output: [
 				...files.map((file) => `wrote ${file.path}`),
 				...compiled.publication === void 0 ? [] : [`add the tables outside public to the powersync publication: ${compiled.publication}`],
-				...warnings
+				...warnings,
+				...compiled.claims.map((line) => `PD084: ${line}`)
 			].join("\n")
 		};
 	}
 	const mismatches = stale.map((file) => `${file.path} ${file.missing ? "is missing" : "differs from the policy"}: run permdock powersync generate`);
-	const notes = [...warnings];
+	const notes = [...warnings, ...compiled.claims.map((line) => `PD084: ${line}`)];
 	if (input.db !== void 0) try {
 		const fixturesPath = input.fixtures ?? input.config.rls?.fixtures ?? "rls.fixtures.json";
 		const { fixtures, customRoles } = await loadFixtures(input.cwd, fixturesPath, true);

package/dist/{powersync-BZxw_v-A.js → powersync-DStC_g0B.js}

@@ -14,7 +14,7 @@ const generate = defineLeaf({
 	async run(ctx, { flags }) {
 		const out = fileOut("powersync", flags.out);
 		const from = given(flags.policy);
-		const { runPowerSync } = await import("./powersync-Cqzx25dI.js");
+		const { runPowerSync } = await import("./powersync-xNRlC4jN.js");
 		return runPowerSync({
 			cwd: ctx.cwd,
 			config: ctx.config,
@@ -45,7 +45,7 @@ const verify = defineLeaf({
 		const db = await dbUrl(ctx, flags, { required: true });
 		const fixtures = given(flags.fixtures);
 		const from = given(flags.policy);
-		const { runPowerSync } = await import("./powersync-Cqzx25dI.js");
+		const { runPowerSync } = await import("./powersync-xNRlC4jN.js");
 		return runPowerSync({
 			cwd: ctx.cwd,
 			config: ctx.config,

package/dist/powersync-xNRlC4jN.js

@@ -0,0 +1 @@
+export { n as runPowerSync } from "./powersync-9PYOE1wt.js";

package/dist/prisma/index.d.ts

@@ -1,5 +1,5 @@
-import { Kt as Instant, wr as Condition, yr as Subject } from "../policy-types-IRJVABmm.js";
-import { f as WhereResult } from "../permdock-DUWZEOLR.js";
+import { Kt as Instant, wr as Condition, yr as Subject } from "../policy-types-D-GwfQTc.js";
+import { f as WhereResult } from "../permdock-ffY4CMd9.js";
 import { r as RelationsMapping } from "../graph-sql-BwFC4Qjs.js";
 import { n as RowCheck, t as WithSubjectOptions } from "../subject-settings-vNW8qmUH.js";
 //#region src/prisma/model-fields.d.ts

package/dist/{protected-action-qowj6nxN.js → protected-action-B40tU3yP.js}

@@ -1,5 +1,5 @@
-import { n as actionRunner, t as actionApproval } from "./protected-action-B6n6w7Rl.js";
-import { c as rolesView, d as subjectView, f as tenantView, i as gateView, l as scopedTenant, n as describeWith, o as permissionSet, r as filterResult, s as protectedView, t as approvalHandle, u as slotContent } from "./views-TrZYlDnM.js";
+import { n as actionRunner, t as actionApproval } from "./protected-action-OpOxtTsN.js";
+import { c as rolesView, d as subjectView, f as tenantView, i as gateView, l as scopedTenant, n as describeWith, o as permissionSet, r as filterResult, s as protectedView, t as approvalHandle, u as slotContent } from "./views-MWmJ6Y4P.js";
 import { n as storeOf } from "./store-options--zWn48PK.js";
 import { a as PermDockUiContext, i as PermDockStoreContext, r as PermDockSnapshotPromiseContext } from "./live-options-BBIT68le.js";
 import { Suspense, use, useEffect, useLayoutEffect, useMemo, useState, useSyncExternalStore } from "react";

package/dist/{protected-action-D3S9U4nc.d.ts → protected-action-Ds_EUY8B.d.ts}

@@ -1,11 +1,11 @@
-import { M as PolicyVocabulary, gr as Membership, qn as Decision } from "./policy-types-IRJVABmm.js";
+import { M as PolicyVocabulary, gr as Membership, qn as Decision } from "./policy-types-D-GwfQTc.js";
 import { u as Permission } from "./permission-types-CAY-GU7e.js";
 import { r as Role } from "./vocabulary-DEJ5j4mR.js";
-import { d as UncheckedData, s as RowData } from "./permdock-DUWZEOLR.js";
-import { r as DescribeOptions, t as DecisionDescription } from "./describe-nalX_HHE.js";
-import { _ as TenantView, a as ClientPermDock, c as GateMode, d as PermissionState, f as ProtectedActionHandle, g as SubjectView, h as RolesOptions, l as GateView, r as ApprovalHandle, s as FilterResult, u as PermissionSet, y as ProtectedAction } from "./store-g5ctUrOI.js";
+import { d as UncheckedData, s as RowData } from "./permdock-ffY4CMd9.js";
+import { r as DescribeOptions, t as DecisionDescription } from "./describe-BKtC_8PG.js";
+import { _ as TenantView, a as ClientPermDock, c as GateMode, d as PermissionState, f as ProtectedActionHandle, g as SubjectView, h as RolesOptions, l as GateView, r as ApprovalHandle, s as FilterResult, u as PermissionSet, y as ProtectedAction } from "./store-DYeB-_U3.js";
 import { r as RefreshTrigger } from "./refresh-on-L9UOwATg.js";
-import { r as ProtectedProps } from "./types-e82uzrTn.js";
+import { r as ProtectedProps } from "./types-DmbfLu2p.js";
 import { ReactNode } from "react";
 //#region src/react/hooks.d.ts
 declare function usePermDock<V extends PolicyVocabulary = PolicyVocabulary>(): ClientPermDock<V>;

package/dist/{protected-action-B6n6w7Rl.js → protected-action-OpOxtTsN.js}

@@ -1,6 +1,6 @@
 import { a as problemType } from "./problem-details-CLDgX1KV.js";
 import { t as approvalHeaderValue } from "./approval-header-8QV6MU4H.js";
-import { t as approvalHandle } from "./views-TrZYlDnM.js";
+import { t as approvalHandle } from "./views-MWmJ6Y4P.js";
 //#region src/client/headers.ts
 /**
 * The `PermDock-Approval` header for a resume; a `TypeError` for a token that

package/dist/{provider-CjAu39fJ.d.ts → provider-OtnIiFWm.d.ts}

@@ -1,4 +1,4 @@
-import { n as PermDockProviderProps } from "./types-e82uzrTn.js";
+import { n as PermDockProviderProps } from "./types-DmbfLu2p.js";
 import { ReactElement } from "react";
 //#region src/react/provider.d.ts
 declare function PermDockProvider(props: PermDockProviderProps): ReactElement;

package/dist/{pull-DVoZ0V9_.js → pull-DLP4I1Kl.js}

@@ -5,9 +5,9 @@ import { s as writeFileEnsuringDir } from "./files-BSjrtIHw.js";
 import { s as cliVersion } from "./version-DMQ0dnN5.js";
 import { o as formatCatalogJson } from "./catalog-doc-C4DGfJCO.js";
 import { t as catalogPath } from "./catalog-path-CnI0XTFK.js";
-import { n as parseSupabaseManifest } from "./manifest-BXTbHNIV.js";
+import { n as parseSupabaseManifest } from "./manifest-BdzBobNK.js";
 import { t as parseCatalog } from "./parse-UTC-sDrt.js";
-import { a as nonEmptyOr } from "./output-DhTpe8v1.js";
+import { a as nonEmptyOr } from "./output-BFWLER4r.js";
 import { t as POLICY_NOT_PUBLISHED } from "./problem-types-DSsRfONQ.js";
 import { n as httpRequest, t as authFailure } from "./http-DhMWeB_h.js";
 import { l as cloudUrl, n as cliRuntime, o as readAuth } from "./auth-j3Eu-j4h.js";

package/dist/pull-UBjDnf4b.js

@@ -0,0 +1 @@
+export { n as runCloudPull } from "./pull-DLP4I1Kl.js";

package/dist/{push-eJl1Tvqm.js → push-BSb8j1EW.js}

@@ -4,10 +4,10 @@ import { t as catalogFingerprint } from "./catalog-fingerprint-e6aCWosn.js";
 import { a as describeError, n as CliError } from "./errors-BhRkoNS7.js";
 import { s as cliVersion } from "./version-DMQ0dnN5.js";
 import { i as loadConfiguredPolicy } from "./load-BaEamml-.js";
-import { n as parseSupabaseManifest } from "./manifest-BXTbHNIV.js";
+import { n as parseSupabaseManifest } from "./manifest-BdzBobNK.js";
 import { t as parseCatalog } from "./parse-UTC-sDrt.js";
-import { r as pushedPolicy } from "./pushed-policy-DMXAOmEW.js";
-import { n as runCatalog } from "./catalog-DGDd_ww1.js";
+import { r as pushedPolicy } from "./pushed-policy-BecMsTtM.js";
+import { n as runCatalog } from "./catalog-D1fw8qif.js";
 import { n as httpRequest, t as authFailure } from "./http-DhMWeB_h.js";
 import { a as pushAuth, l as cloudUrl, n as cliRuntime, u as firstNonEmpty } from "./auth-j3Eu-j4h.js";
 import "./manifest-json-CAGzls-C.js";

package/dist/{pushed-policy-DMXAOmEW.js → pushed-policy-BecMsTtM.js}

@@ -3,7 +3,7 @@ import { n as freezeDeep } from "./freeze-jjan0lCv.js";
 import { n as PermDockValidationError } from "./validation-error-CYg2kJEw.js";
 import { n as RFC3339_PATTERN } from "./time-nR1JesoH.js";
 import { i as wireValidity } from "./validity-Buc7w8E9.js";
-import { n as snapshotScopes } from "./instance-snapshot-BgOGtyCy.js";
+import { n as snapshotScopes } from "./instance-snapshot-BWa71my8.js";
 import { n as copyJson, r as forbiddenKeyPath, t as checkSchema } from "./json-schema-BPGa-RjQ.js";
 //#region src/catalog/pushed-policy.ts
 const strings = {

package/dist/{pushed-policy-CUQuvlS3.d.ts → pushed-policy-Ck3FZcoy.d.ts}

@@ -1,4 +1,4 @@
-import { E as Policy, Gn as AppObligation, Pn as Grantee, U as WireValidity, d as BreakGlassSpec, o as ApprovalRequirement, rn as SnapshotScope, v as GrantLimit, wr as Condition, y as GrantMeta } from "./policy-types-IRJVABmm.js";
+import { E as Policy, Gn as AppObligation, Pn as Grantee, U as WireValidity, d as BreakGlassSpec, o as ApprovalRequirement, rn as SnapshotScope, v as GrantLimit, wr as Condition, y as GrantMeta } from "./policy-types-D-GwfQTc.js";
 import { t as JsonSchemaNode } from "./json-schema-BfXgnRNT.js";
 //#region src/catalog/pushed-policy.d.ts
 /**

package/dist/react/index.d.ts

@@ -1,9 +1,9 @@
-import { c as requiredPlans } from "../errors-Dc9FdamT.js";
-import { i as describe } from "../describe-nalX_HHE.js";
-import { _ as TenantView, a as ClientPermDock, c as GateMode, d as PermissionState, f as ProtectedActionHandle, g as SubjectView, h as RolesOptions, i as ApprovalState, l as GateView, o as ClientStatus, p as ProtectedActionView, r as ApprovalHandle, s as FilterResult, u as PermissionSet, v as ActionResult, y as ProtectedAction } from "../store-g5ctUrOI.js";
+import { c as requiredPlans } from "../errors-TpzkEKgJ.js";
+import { i as describe } from "../describe-BKtC_8PG.js";
+import { _ as TenantView, a as ClientPermDock, c as GateMode, d as PermissionState, f as ProtectedActionHandle, g as SubjectView, h as RolesOptions, i as ApprovalState, l as GateView, o as ClientStatus, p as ProtectedActionView, r as ApprovalHandle, s as FilterResult, u as PermissionSet, v as ActionResult, y as ProtectedAction } from "../store-DYeB-_U3.js";
 import { a as broadcastChannelRefresh, c as visibilityRefresh, i as authzChangeRefresh, n as EventSourceRefreshOptions, o as eventSourceRefresh, r as RefreshTrigger, s as focusRefresh, t as AuthzChangeRefresh } from "../refresh-on-L9UOwATg.js";
-import { n as PermDockProviderProps, r as ProtectedProps, t as PermDockDefaults } from "../types-e82uzrTn.js";
+import { n as PermDockProviderProps, r as ProtectedProps, t as PermDockDefaults } from "../types-DmbfLu2p.js";
 import { t as approvalHeaders } from "../headers-B9jQxjtW.js";
-import { a as useAssignableRoles, c as useGate, d as usePermission, f as usePermissions, g as useTenant, h as useSubject, i as useAssignablePermissions, l as useMemberships, m as useRoles, n as Protected, o as useDescribe, p as useRefreshOn, r as useApproval, s as useFilter, t as useProtectedAction, u as usePermDock } from "../protected-action-D3S9U4nc.js";
-import { t as PermDockProvider } from "../provider-CjAu39fJ.js";
+import { a as useAssignableRoles, c as useGate, d as usePermission, f as usePermissions, g as useTenant, h as useSubject, i as useAssignablePermissions, l as useMemberships, m as useRoles, n as Protected, o as useDescribe, p as useRefreshOn, r as useApproval, s as useFilter, t as useProtectedAction, u as usePermDock } from "../protected-action-Ds_EUY8B.js";
+import { t as PermDockProvider } from "../provider-OtnIiFWm.js";
 export { type ActionResult, type ApprovalHandle, type ApprovalState, type AuthzChangeRefresh, type ClientPermDock, type ClientStatus, type EventSourceRefreshOptions, type FilterResult, type GateMode, type GateView, type PermDockDefaults, PermDockProvider, type PermDockProviderProps, type PermissionSet, type PermissionState, Protected, type ProtectedAction, type ProtectedActionHandle, type ProtectedActionView, type ProtectedProps, type RefreshTrigger, type RolesOptions, type SubjectView, type TenantView, approvalHeaders, authzChangeRefresh, broadcastChannelRefresh, describe, eventSourceRefresh, focusRefresh, requiredPlans, useApproval, useAssignablePermissions, useAssignableRoles, useDescribe, useFilter, useGate, useMemberships, usePermDock, usePermission, usePermissions, useProtectedAction, useRefreshOn, useRoles, useSubject, useTenant, visibilityRefresh };

package/dist/react/index.js

@@ -1,8 +1,8 @@
 "use client";
 import { r as requiredPlans } from "../problem-details-CLDgX1KV.js";
-import { n as describe } from "../describe-CogP1loh.js";
-import { r as approvalHeaders } from "../protected-action-B6n6w7Rl.js";
+import { n as describe } from "../describe-BZAlPHxT.js";
+import { r as approvalHeaders } from "../protected-action-OpOxtTsN.js";
 import { a as eventSourceRefresh, i as broadcastChannelRefresh, o as focusRefresh, r as authzChangeRefresh, s as visibilityRefresh } from "../store-options--zWn48PK.js";
-import { a as useAssignableRoles, c as useGate, d as usePermission, f as usePermissions, g as useTenant, h as useSubject, i as useAssignablePermissions, l as useMemberships, m as useRoles, n as Protected, o as useDescribe, p as useRefreshOn, r as useApproval, s as useFilter, t as useProtectedAction, u as usePermDock } from "../protected-action-qowj6nxN.js";
+import { a as useAssignableRoles, c as useGate, d as usePermission, f as usePermissions, g as useTenant, h as useSubject, i as useAssignablePermissions, l as useMemberships, m as useRoles, n as Protected, o as useDescribe, p as useRefreshOn, r as useApproval, s as useFilter, t as useProtectedAction, u as usePermDock } from "../protected-action-B40tU3yP.js";
 import { t as PermDockProvider } from "../provider-CY4TSSJo.js";
 export { PermDockProvider, Protected, approvalHeaders, authzChangeRefresh, broadcastChannelRefresh, describe, eventSourceRefresh, focusRefresh, requiredPlans, useApproval, useAssignablePermissions, useAssignableRoles, useDescribe, useFilter, useGate, useMemberships, usePermDock, usePermission, usePermissions, useProtectedAction, useRefreshOn, useRoles, useSubject, useTenant, visibilityRefresh };

package/dist/react/provider-client.d.ts

@@ -1,2 +1,2 @@
-import { t as PermDockProvider } from "../provider-CjAu39fJ.js";
+import { t as PermDockProvider } from "../provider-OtnIiFWm.js";
 export { PermDockProvider };

package/dist/react-native/index.d.ts

@@ -1,14 +1,15 @@
-import { $t as Snapshot, Jt as LocalMembershipRows, Kt as Instant, Qt as LocalSnapshotRows, Xt as LocalRowValue, Yt as LocalRowColumn, Zt as LocalSnapshotManifest, dr as CustomRole, gr as Membership, lt as SnapshotSource } from "../policy-types-IRJVABmm.js";
+import { $t as Snapshot, Jt as LocalMembershipRows, Kt as Instant, Qt as LocalSnapshotRows, Xt as LocalRowValue, Yt as LocalRowColumn, Zt as LocalSnapshotManifest, dr as CustomRole, gr as Membership, lt as SnapshotSource } from "../policy-types-D-GwfQTc.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
-import { c as requiredPlans } from "../errors-Dc9FdamT.js";
-import { i as describe } from "../describe-nalX_HHE.js";
-import { t as parseLocalSnapshotManifest } from "../parse-local-manifest-BgTYdR3q.js";
-import { _ as TenantView, a as ClientPermDock, c as GateMode, d as PermissionState, f as ProtectedActionHandle, g as SubjectView, h as RolesOptions, i as ApprovalState, l as GateView, o as ClientStatus, p as ProtectedActionView, r as ApprovalHandle, s as FilterResult, t as ClientStore, u as PermissionSet, v as ActionResult, y as ProtectedAction } from "../store-g5ctUrOI.js";
+import { c as requiredPlans } from "../errors-TpzkEKgJ.js";
+import { i as describe } from "../describe-BKtC_8PG.js";
+import { t as parseLocalSnapshotManifest } from "../parse-local-manifest-DvjTQNuO.js";
+import { _ as TenantView, a as ClientPermDock, c as GateMode, d as PermissionState, f as ProtectedActionHandle, g as SubjectView, h as RolesOptions, i as ApprovalState, l as GateView, o as ClientStatus, p as ProtectedActionView, r as ApprovalHandle, s as FilterResult, t as ClientStore, u as PermissionSet, v as ActionResult, y as ProtectedAction } from "../store-DYeB-_U3.js";
 import { i as authzChangeRefresh, n as EventSourceRefreshOptions, o as eventSourceRefresh, r as RefreshTrigger, t as AuthzChangeRefresh } from "../refresh-on-L9UOwATg.js";
-import { r as ProtectedProps, t as PermDockDefaults } from "../types-e82uzrTn.js";
+import { r as ProtectedProps, t as PermDockDefaults } from "../types-DmbfLu2p.js";
 import { t as approvalHeaders } from "../headers-B9jQxjtW.js";
-import { a as useAssignableRoles, c as useGate, d as usePermission, f as usePermissions, g as useTenant, h as useSubject, i as useAssignablePermissions, l as useMemberships, m as useRoles, n as Protected, o as useDescribe, r as useApproval, s as useFilter, t as useProtectedAction, u as usePermDock } from "../protected-action-D3S9U4nc.js";
-import { a as SubscribeOnline, i as SubscribeForeground, n as ReactNativePermDockProviderProps, r as SnapshotStorage, t as NativeRevalidate } from "../types-D29K5ZNP.js";
+import { a as useAssignableRoles, c as useGate, d as usePermission, f as usePermissions, g as useTenant, h as useSubject, i as useAssignablePermissions, l as useMemberships, m as useRoles, n as Protected, o as useDescribe, r as useApproval, s as useFilter, t as useProtectedAction, u as usePermDock } from "../protected-action-Ds_EUY8B.js";
+import { n as RealtimeRefreshClient, t as RealtimeRefreshChannel } from "../client-CH7vzSAY.js";
+import { a as SubscribeOnline, i as SubscribeForeground, n as ReactNativePermDockProviderProps, r as SnapshotStorage, t as NativeRevalidate } from "../types-o1vu6Ks3.js";
 import { ReactElement } from "react";
 //#region src/react-native/guards.d.ts
 /**
@@ -42,6 +43,11 @@ type LocalSnapshotData = {
   } | null;
   /** The tenant's custom roles, in the shape a `CustomRoleSource` returns. */
   readonly customRoles?: readonly CustomRole[];
+  /**
+   * The user's synced authorization version, set as `Snapshot.authzVersion`.
+   * Anything but a non-negative safe integer is ignored.
+   */
+  readonly authzVersion?: number;
 };
 type LocalSnapshotOptions = {
   /** `localSnapshotManifest(policy)`, written at build time. */
@@ -138,6 +144,94 @@ type PowerSyncSourceCache = {
  */
 export declare function powerSyncSourceCache(db: PowerSyncWatchable): PowerSyncSourceCache;
 //#endregion
+//#region src/react-native/subscriptions.d.ts
+/** The `AppState` export of `react-native`, as `appStateForeground` calls it. */
+type AppStateModule = {
+  addEventListener: (type: "change", listener: (state: string) => void) => {
+    remove: () => void;
+  };
+};
+/**
+ * The default export of `@react-native-community/netinfo`, as `netInfoOnline`
+ * calls it.
+ */
+type NetInfoModule = {
+  addEventListener: (listener: (state: {
+    readonly isConnected: boolean | null;
+    readonly isInternetReachable?: boolean | null;
+  }) => void) => () => void;
+};
+/**
+ * `subscribeForeground` over `AppState`: `active` returns to the foreground and
+ * `background` leaves it. iOS `inactive` (a system sheet over the app) is
+ * neither.
+ */
+export declare function appStateForeground(appState: AppStateModule): SubscribeForeground;
+/**
+ * `subscribeOnline` over NetInfo. An unknown (`null`) connection counts as
+ * online.
+ */
+export declare function netInfoOnline(netInfo: NetInfoModule): SubscribeOnline;
+//#endregion
+//#region src/react-native/native-refresh.d.ts
+/** The part of a supabase-js session `nativeRefresh` reads. */
+type NativeRefreshSession = {
+  readonly access_token: string;
+  readonly user: {
+    readonly id: string;
+  };
+};
+/** The part of a React Native supabase-js client `nativeRefresh` uses. */
+type NativeRefreshSupabase<C extends RealtimeRefreshChannel = RealtimeRefreshChannel> = RealtimeRefreshClient<C> & {
+  readonly auth: {
+    readonly getSession: () => Promise<{
+      readonly data: {
+        readonly session: NativeRefreshSession | null;
+      };
+    }>;
+    readonly refreshSession: () => Promise<unknown>;
+  };
+};
+/** The `PowerSyncDatabase` methods `nativeRefresh` calls. */
+type NativeRefreshDatabase<K> = PowerSyncWatchable & {
+  readonly connect: (connector: K) => Promise<void>;
+  readonly disconnect: () => Promise<void>;
+};
+type NativeRefreshPowerSync<K> = {
+  readonly db: NativeRefreshDatabase<K>;
+  /** The connector the app connects with; a reconnect fetches a new token. */
+  readonly connector: K;
+  /**
+   * The manifest `permdock powersync generate` writes. With its `rows.version`,
+   * a synced version above the token's `authz_ver` runs a refresh, which covers
+   * a message sent while the app was closed.
+   */
+  readonly manifest?: LocalSnapshotManifest;
+};
+type NativeRefreshOptions<C extends RealtimeRefreshChannel = RealtimeRefreshChannel, K = unknown> = {
+  readonly supabase: NativeRefreshSupabase<C>;
+  /** The `AppState` export of `react-native`. */
+  readonly appState: AppStateModule;
+  /**
+   * The default export of `@react-native-community/netinfo`. A signal that
+   * arrives offline waits for the connection, then runs once.
+   */
+  readonly netInfo?: NetInfoModule;
+  /** Reconnects PowerSync after the session refresh. */
+  readonly powersync?: NativeRefreshPowerSync<K>;
+};
+/**
+ * A `refreshOn` trigger for an Expo app on Supabase: on each message on the
+ * user's private `authz:<uid>` topic it refreshes the Supabase session, then
+ * reconnects PowerSync so streams that read token claims see the new ones, then
+ * refreshes the snapshot. Passes run one at a time; signals during a pass fold
+ * into one more. The channel closes in the background and rejoins on
+ * foreground, where one catch-up pass runs: a version check with
+ * `powersync.manifest`, else a full pass. It never imports `@supabase/*` or
+ * `@powersync/*`.
+ */
+export declare function nativeRefresh<C extends RealtimeRefreshChannel, K = unknown>(options: NativeRefreshOptions<C, K>): RefreshTrigger;
+//#endregion
 //#region src/react-native/provider.d.ts
 export declare function PermDockProvider(props: ReactNativePermDockProviderProps): ReactElement;
 //#endregion
@@ -175,35 +269,6 @@ export declare function secureStoreStorage(store: SecureStoreModule, options?: o
  */
 export declare function mmkvStorage(mmkv: MmkvInstance): SnapshotStorage;
 //#endregion
-//#region src/react-native/subscriptions.d.ts
-/** The `AppState` export of `react-native`, as `appStateForeground` calls it. */
-type AppStateModule = {
-  addEventListener: (type: "change", listener: (state: string) => void) => {
-    remove: () => void;
-  };
-};
-/**
- * The default export of `@react-native-community/netinfo`, as `netInfoOnline`
- * calls it.
- */
-type NetInfoModule = {
-  addEventListener: (listener: (state: {
-    readonly isConnected: boolean | null;
-    readonly isInternetReachable?: boolean | null;
-  }) => void) => () => void;
-};
-/**
- * `subscribeForeground` over `AppState`: `active` returns to the foreground and
- * `background` leaves it. iOS `inactive` (a system sheet over the app) is
- * neither.
- */
-export declare function appStateForeground(appState: AppStateModule): SubscribeForeground;
-/**
- * `subscribeOnline` over NetInfo. An unknown (`null`) connection counts as
- * online.
- */
-export declare function netInfoOnline(netInfo: NetInfoModule): SubscribeOnline;
-//#endregion
 //#region src/react-native/store.d.ts
 type NativeStoreOptions = Omit<ReactNativePermDockProviderProps, "children" | "headers" | "defaults" | "messages"> & {
   readonly headers?: Readonly<Record<string, string>> | (() => Readonly<Record<string, string>> | undefined);
@@ -222,4 +287,4 @@ type NativeStoreOptions = Omit<ReactNativePermDockProviderProps, "children" | "h
 export declare function connectSource(store: ClientStore, source: SnapshotSource, subscribeForeground?: SubscribeForeground): () => void;
 export declare function nativeStore(options: NativeStoreOptions): ClientStore;
 //#endregion
-export { type ActionResult, type AppStateModule, type ApprovalHandle, type ApprovalState, type AuthzChangeRefresh, type ClientPermDock, type ClientStatus, type EventSourceRefreshOptions, type FilterResult, type GateMode, type GateView, type LocalMembershipRows, type LocalRowColumn, type LocalRowValue, type LocalSnapshotData, type LocalSnapshotManifest, type LocalSnapshotOptions, type LocalSnapshotRows, type MmkvInstance, type NativeRevalidate, type NetInfoModule, type PermDockDefaults, type PermissionSet, type PermissionState, type PowerSyncQuery, type PowerSyncSourceCache, type PowerSyncSourceOptions, type PowerSyncWatchable, Protected, type ProtectedAction, type ProtectedActionHandle, type ProtectedActionView, type ProtectedProps, type ReactNativePermDockProviderProps, type RefreshTrigger, type RolesOptions, type SecureStoreModule, type SnapshotSource, type SnapshotStorage, type SubjectView, type SubscribeForeground, type SubscribeOnline, type TenantView, approvalHeaders, authzChangeRefresh, describe, eventSourceRefresh, parseLocalSnapshotManifest, requiredPlans, useApproval, useAssignablePermissions, useAssignableRoles, useDescribe, useFilter, useGate, useMemberships, usePermDock, usePermission, usePermissions, useProtectedAction, useRoles, useSubject, useTenant };
+export { type ActionResult, type AppStateModule, type ApprovalHandle, type ApprovalState, type AuthzChangeRefresh, type ClientPermDock, type ClientStatus, type EventSourceRefreshOptions, type FilterResult, type GateMode, type GateView, type LocalMembershipRows, type LocalRowColumn, type LocalRowValue, type LocalSnapshotData, type LocalSnapshotManifest, type LocalSnapshotOptions, type LocalSnapshotRows, type MmkvInstance, type NativeRefreshDatabase, type NativeRefreshOptions, type NativeRefreshPowerSync, type NativeRefreshSession, type NativeRefreshSupabase, type NativeRevalidate, type NetInfoModule, type PermDockDefaults, type PermissionSet, type PermissionState, type PowerSyncQuery, type PowerSyncSourceCache, type PowerSyncSourceOptions, type PowerSyncWatchable, Protected, type ProtectedAction, type ProtectedActionHandle, type ProtectedActionView, type ProtectedProps, type ReactNativePermDockProviderProps, type RefreshTrigger, type RolesOptions, type SecureStoreModule, type SnapshotSource, type SnapshotStorage, type SubjectView, type SubscribeForeground, type SubscribeOnline, type TenantView, approvalHeaders, authzChangeRefresh, describe, eventSourceRefresh, parseLocalSnapshotManifest, requiredPlans, useApproval, useAssignablePermissions, useAssignableRoles, useDescribe, useFilter, useGate, useMemberships, usePermDock, usePermission, usePermissions, useProtectedAction, useRoles, useSubject, useTenant };