permdock 0.3.1 → 0.4.0

package/dist/{policy-D2W7uv19.d.ts → policy-ur0BBK_e.d.ts}

@@ -1,5 +1,5 @@
-import { C as Policy, Nr as Principal, Pr as Subject } from "./policy-IB6yxpC3.js";
-import { c as saasPlans, l as saasRoles, s as saasPermissions } from "./permissions-CDgvKG5L.js";
+import { E as Policy, Or as Principal, kr as Subject } from "./policy-types-sp9P1iIV.js";
+import { c as saasPlans, l as saasRoles, s as saasPermissions } from "./permissions-COH-KRgT.js";
 //#region src/testing/saas/policy.d.ts
 /** Daily API-key quota per subject; the bucket should be per tenant too. */
 declare const SAAS_API_KEY_LIMIT = 5;

package/dist/{powersync-DE19b9dT.js → powersync-BFSbSElQ.js}

@@ -1,4 +1,4 @@
-import { i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-BeaGNj_o.js";
+import { i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-Cpip4ULx.js";
 import { defineCommand } from "citty";
 //#region src/cli/commands/powersync.ts
 function powersync(ctx) {
@@ -44,7 +44,7 @@ function powersync(ctx) {
 			const db = stringArg(parsed.db);
 			const fixtures = stringArg(parsed.fixtures);
 			const from = stringArg(parsed.from);
-			const { runPowerSync } = await import("./powersync-CrBX8hY6.js");
+			const { runPowerSync } = await import("./powersync-DCDgZgfZ.js");
 			ctx.report(await runPowerSync({
 				cwd: ctx.cwd,
 				config: ctx.config,

package/dist/powersync-DCDgZgfZ.js

@@ -0,0 +1,2 @@
+import { n as runPowerSync } from "./powersync-cZe4kzhL.js";
+export { runPowerSync };

package/dist/{powersync-Dv1_aWF7.js → powersync-cZe4kzhL.js}

@@ -1,22 +1,24 @@
-import { i as findPermission } from "./permissions-DVoF6dMt.js";
-import { c as isConditionRef, s as isConditionDate } from "./refs-KYb4ntaz.js";
-import { _ as memoryRoleSource, p as localSnapshotManifest } from "./src-BDwEZWrZ.js";
-import { d as scopeList, o as resolveScope } from "./scopes-CVdPrWN-.js";
+import { c as isConditionRef, s as isConditionDate } from "./refs-f3imMjNW.js";
+import { d as localSnapshotManifest, g as memoryRoleSource } from "./src-Bb7no-hS.js";
+import { d as scopeList, o as resolveScope } from "./scopes-tvpa34ep.js";
+import { n as findPermission } from "./permission-registry-BsblpB-z.js";
 import { t as requiresApproval } from "./approval-required-TzNB9oQA.js";
-import { t as createPermDock } from "./permdock-CbgvLnuo.js";
+import { t as createPermDock } from "./permdock-L26udHSk.js";
 import { o as usageResult } from "./errors-CWfoNg9N.js";
-import { a as loadModule, n as asPolicy, o as pickNamed } from "./load-DhWEB9P1.js";
-import { i as scopeMembershipTable, r as scopeColumn } from "./compile-Ba4blROR.js";
-import { i as quoteSqlLiteral, t as SQL_IDENT } from "./sql-xdg5f4Fi.js";
-import "./sources-4p0-4xQm.js";
-import { G as quoteIdent, t as CUSTOM_ROLES } from "./rls-shared-Cewd_-zI.js";
-import { H as collectGrants, W as contextRefs, h as tableFor, w as connectPg } from "./rls-fields-CZOMlwHl.js";
-import { n as fixtureSubject, r as loadFixtures, t as fixtureRow } from "./fixtures-ht28Cplr.js";
-import { a as ownershipRules } from "./rls-ownership-DcYlZ09B.js";
-import { t as canFixture } from "./rls-verify-CMv9H3wV.js";
-import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { c as requirePolicy } from "./load-C3_oTHyO.js";
+import { i as scopeMembershipTable, r as scopeColumn } from "./compile-CcEu2ZQ1.js";
+import { o as quoteSqlLiteral, t as SQL_IDENT } from "./sql-t8teWOfo.js";
+import "./sources-B1-b-R0t.js";
+import { n as fixtureSubject, r as loadFixtures, t as fixtureRow } from "./fixtures-h2eG2OZV.js";
+import { N as quoteIdent, a as customRolesOn, t as CUSTOM_ROLES } from "./shared-1uhI-e-b.js";
+import { r as fileDrift } from "./output-files-CgIsvdSa.js";
+import { E as collectGrants, Z as pgConnector, k as contextRefs } from "./permission-keys-B26jeyUv.js";
+import { t as ownershipRules } from "./ownership-BgnbOJFT.js";
+import { h as tableFor } from "./fields-fwfXN01n.js";
+import { t as canFixture } from "./verify-BztUB3GX.js";
+import { writeFileSync } from "node:fs";
 import { resolve } from "node:path";
-//#region src/cli/powersync-streams.ts
+//#region src/cli/powersync/streams.ts
 function ident(name) {
 	if (!SQL_IDENT.test(name)) throw new TypeError(`PermDock CLI: '${name}' is not a plain identifier, which Sync Streams need`);
 	return name;
@@ -228,7 +230,7 @@ function subjectStreams(ctx) {
 	const database = rls?.authorize === "database";
 	const globalRoles = rls?.roles ?? (database ? { table: `${schema}.user_roles` } : void 0);
 	if (globalRoles !== void 0) own(globalRoles.table, globalRoles.user ?? "user_id", globalRoles.role ?? "role");
-	if (database && rls?.customRoles === true) {
+	if (database && customRolesOn(rls)) {
 		const root = ctx.scopes[0]?.name;
 		const tenants = root === void 0 ? void 0 : scopeMembershipTable(memberships, ctx.scopes, root);
 		const column = tenants === void 0 || root === void 0 ? void 0 : scopeColumn(tenants, ctx.scopes, root);
@@ -364,17 +366,15 @@ function powersyncYaml(plan) {
 	return `${lines.join("\n")}\n`;
 }
 //#endregion
-//#region src/cli/powersync.ts
+//#region src/cli/powersync/powersync.ts
 const POWERSYNC_HELP = `permdock powersync generate [--out sync-config.yaml] [--check]
 permdock powersync verify [--db <url>] [--fixtures rls.fixtures.json]`;
 const DEFAULT_OUT = "sync-config.yaml";
 function powersyncOut(config, out) {
 	return out ?? config.powersync?.out ?? DEFAULT_OUT;
 }
-async function loadPolicy(cwd, config, from) {
-	const path = from ?? config.policy;
-	if (path === void 0) throw new Error("PermDock CLI: powersync needs policy in the config or --from");
-	return asPolicy(pickNamed(await loadModule(resolve(cwd, path)), ["policy"]));
+function loadPolicy(cwd, config, from) {
+	return requirePolicy(cwd, from ?? config.policy, "powersync needs policy in the config or --from");
 }
 function sameJson(current, expected) {
 	try {
@@ -409,11 +409,10 @@ function powersyncFiles(policy, config, out) {
 function staleFiles(cwd, files) {
 	const stale = [];
 	for (const file of files) {
-		const path = resolve(cwd, file.path);
-		const current = existsSync(path) ? readFileSync(path, "utf8") : void 0;
-		if (!(current !== void 0 && (file.json === true ? sameJson(current, file.text) : current === file.text))) stale.push({
+		const found = fileDrift(resolve(cwd, file.path), file.text, file.json === true ? sameJson : void 0);
+		if (found !== void 0) stale.push({
 			path: file.path,
-			missing: current === void 0
+			missing: found.kind === "missing"
 		});
 	}
 	return stale;
@@ -519,7 +518,7 @@ async function runPowerSync(input) {
 			fixtures,
 			customRoles,
 			db: input.db,
-			connect: input.connect ?? ((db) => connectPg(db, "permdock powersync verify --db"))
+			connect: input.connect ?? pgConnector("permdock powersync verify --db")
 		});
 		mismatches.push(...database.mismatches);
 		notes.push(...database.notes);

package/dist/prisma/index.d.ts

@@ -1,4 +1,4 @@
-import { Ir as Condition, Pr as Subject, mn as WhereResult } from "../policy-IB6yxpC3.js";
+import { It as WhereResult, jr as Condition, kr as Subject } from "../policy-types-sp9P1iIV.js";
 import { r as RelationsMapping } from "../graph-sql-B-dsAT6j.js";
 import { n as WithSubjectOptions, t as RowCheck } from "../row-check-Dt35czLy.js";
 //#region src/prisma/model-fields.d.ts

package/dist/prisma/index.js

@@ -1,9 +1,9 @@
-import { t as compact } from "../compact-y6vfu2_f.js";
+import { t as compact } from "../compact-CAf557ZB.js";
 import { n as freezeDeep } from "../freeze-CrU8nQeX.js";
-import { w as assertSafeKey } from "../permissions-DVoF6dMt.js";
-import { n as PermDockValidationError } from "../validation-error-CnjZ4t92.js";
-import { a as relatedRowGuard, l as renderGraphSql, n as escapeLike, s as relatedTargetsSql, t as compileWhere, u as restrictedRowsSql } from "../compile-Ba4blROR.js";
-import { a as rowCheckOf, n as statementText, r as subjectStatements } from "../subject-settings-BwBmCdTR.js";
+import { a as assertSafeKey } from "../thenable-QSmvt-vZ.js";
+import { n as PermDockValidationError } from "../validation-error-ZfUHbKvf.js";
+import { a as relatedRowGuard, l as renderGraphSql, n as escapeLike, s as relatedTargetsSql, t as compileWhere, u as restrictedRowsSql } from "../compile-CcEu2ZQ1.js";
+import { n as statementText, o as rowCheckOf, r as subjectStatements, s as loadPeer } from "../subject-settings-CkEwrw3W.js";
 //#region src/prisma/to-where.ts
 function fieldTests(options) {
 	const mapped = (field) => fieldName(field, options.fields);
@@ -165,13 +165,7 @@ async function checkRow(delegate, input, unique, options = {}) {
 //#region src/prisma/predicate.ts
 function loadCombinators(injected) {
 	if (injected !== void 0) return injected;
-	const loader = globalThis.process?.getBuiltinModule?.("node:module");
-	try {
-		if (loader === void 0) throw new Error("no module loader");
-		return loader.createRequire(import.meta.url)("@prisma/orm-postgres/orm-client");
-	} catch {
-		throw new Error("PermDock: toPredicate needs @prisma/orm-postgres; pass `combinators` on runtimes without require");
-	}
+	return loadPeer("@prisma/orm-postgres/orm-client", "PermDock: toPredicate needs @prisma/orm-postgres; pass `combinators` on runtimes without require");
 }
 function refused$1(detail) {
 	return new PermDockValidationError({

package/dist/{problem-B43ztKIm.js → problem-CnWraVhC.js}

@@ -1,7 +1,8 @@
-import { t as compact } from "./compact-y6vfu2_f.js";
-import { n as PermDockValidationError, t as PROBLEM_BASE } from "./validation-error-CnjZ4t92.js";
-import { i as stepUpOf, n as problemDetails, t as notFoundDetails } from "./problem-details-_AMOYz-w.js";
-import { a as deniedMessage, i as approvalMessage } from "./errors-Cz5zn0mW.js";
+import { t as compact } from "./compact-CAf557ZB.js";
+import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
+import { n as PermDockValidationError, t as PROBLEM_BASE } from "./validation-error-ZfUHbKvf.js";
+import { i as stepUpOf, n as problemDetails, t as notFoundDetails } from "./problem-details-DECUnXAn.js";
+import { a as deniedMessage, i as approvalMessage } from "./errors-drnfxYtm.js";
 //#region src/server/problem.ts
 function quoted(value) {
 	return `"${value.replaceAll(/["\\]/gu, "")}"`;
@@ -162,14 +163,14 @@ function problemFromDecision(decision, permission, subject, options = {}) {
 function notFoundProblem(instance) {
 	return problemResponse(notFoundDetails(instance));
 }
-const ANONYMOUS = {
+const ANONYMOUS = freezeDeep({
 	outcome: "denied",
 	denials: [{
 		role: null,
 		reason: "anonymous"
 	}],
 	alternatives: []
-};
+});
 /** The `401` for a request with no subject, with the RFC 6750 challenge its credentials call for. */
 function unauthenticatedProblem(credentials) {
 	return decisionResponse(problemDetails({
@@ -188,4 +189,4 @@ function methodNotAllowed(allow) {
 	return response;
 }
 //#endregion
-export { notFoundProblem as a, protectedResourceMetadataUrl as c, wwwAuthenticate as d, methodNotAllowed as i, unauthenticatedProblem as l, bearerChallenge as n, problemFromDecision as o, decisionResponse as r, problemResponse as s, batchTooLarge as t, validationProblem as u };
+export { methodNotAllowed as a, problemResponse as c, validationProblem as d, wwwAuthenticate as f, decisionResponse as i, protectedResourceMetadataUrl as l, batchTooLarge as n, notFoundProblem as o, bearerChallenge as r, problemFromDecision as s, ANONYMOUS as t, unauthenticatedProblem as u };

package/dist/{problem-details-_AMOYz-w.js → problem-details-DECUnXAn.js}

@@ -1,5 +1,5 @@
-import { t as compact } from "./compact-y6vfu2_f.js";
-import { t as PROBLEM_BASE } from "./validation-error-CnjZ4t92.js";
+import { t as compact } from "./compact-CAf557ZB.js";
+import { t as PROBLEM_BASE } from "./validation-error-ZfUHbKvf.js";
 //#region src/core/wire-denial.ts
 const IN_PROCESS = /* @__PURE__ */ new Set(["closure-error", "validation"]);
 function jsonDetail(value) {

package/dist/{problem-details-DX075l9V.d.ts → problem-details-rIIo8B2C.d.ts}

@@ -1,4 +1,4 @@
-import { Yn as Decision } from "./policy-IB6yxpC3.js";
+import { ir as Decision } from "./policy-types-sp9P1iIV.js";
 //#region src/core/problem-details.d.ts
 type Disclosure = "hide" | "reveal";
 /** The plans a `not-entitled` denial asks for; empty unless every denial is `not-entitled`. */

package/dist/{protected-BdnIEFkY.d.ts → protected-B3_P7xuw.d.ts}

@@ -1,8 +1,9 @@
-import { D as PolicyVocabulary, Mr as Membership, Yn as Decision } from "./policy-IB6yxpC3.js";
-import { f as Permission } from "./permissions-DttnqqxC.js";
-import { r as Role } from "./vocabulary-DA8a8zif.js";
-import { a as FilterResult, c as SubjectView, l as TenantView, o as PermissionSet, r as ClientPermDock, s as PermissionState, t as ApprovalHandle, u as UseRolesOptions } from "./types-CKNSyIf_.js";
-import { n as ProtectedProps } from "./types-BnIEz1sU.js";
+import { Dr as Membership, ir as Decision, j as PolicyVocabulary } from "./policy-types-sp9P1iIV.js";
+import { d as Permission } from "./permission-types-Dg39z9Kv.js";
+import { r as Role } from "./vocabulary-hhEFLFoL.js";
+import { r as DescribeOptions, t as DecisionDescription } from "./describe-C3ldA9os.js";
+import { a as ClientPermDock, c as PermissionSet, d as SubjectView, f as TenantView, l as PermissionState, p as UseRolesOptions, r as ApprovalHandle, s as FilterResult } from "./store-9KO4BlkB.js";
+import { r as ProtectedProps } from "./types-DHrmBJLH.js";
 import { ReactNode } from "react";
 //#region src/react/hooks.d.ts
 declare function usePermDock<V extends PolicyVocabulary = PolicyVocabulary>(): ClientPermDock<V>;
@@ -19,9 +20,11 @@ declare function useAssignablePermissions(options?: {
   readonly tenant?: string;
 }): readonly Permission[];
 declare function useSubject(): SubjectView;
+/** `describe` with the provider's `messages`; a call's own `messages` win. */
+declare function useDescribe(): (decision: Decision, options?: DescribeOptions) => DecisionDescription;
 declare function useApproval(decision: Decision): ApprovalHandle;
 //#endregion
 //#region src/react/protected.d.ts
 declare function Protected(props: ProtectedProps): ReactNode;
 //#endregion
-export { useFilter as a, usePermission as c, useSubject as d, useTenant as f, useAssignableRoles as i, usePermissions as l, useApproval as n, useMemberships as o, useAssignablePermissions as r, usePermDock as s, Protected as t, useRoles as u };
+export { useDescribe as a, usePermDock as c, useRoles as d, useSubject as f, useAssignableRoles as i, usePermission as l, useApproval as n, useFilter as o, useTenant as p, useAssignablePermissions as r, useMemberships as s, Protected as t, usePermissions as u };

package/dist/{protected-utU-SLuy.js → protected-BN7BUdY1.js}

@@ -1,6 +1,6 @@
-import { n as storeOf } from "./store-options-ByhZq1jV.js";
-import { a as protectedView, c as subjectView, i as permissionSet, l as tenantView, n as filterResult, o as rolesView, s as scopedTenant, t as approvalHandle } from "./views-Soe7bGSC.js";
-import { i as PermDockStoreContext, r as PermDockSnapshotPromiseContext } from "./live-options-H2eG8dfJ.js";
+import { n as storeOf } from "./store-options-CbUHDoSe.js";
+import { a as permissionSet, c as scopedTenant, d as tenantView, l as slotContent, n as describeWith, o as protectedView, r as filterResult, s as rolesView, t as approvalHandle, u as subjectView } from "./views-CJsrBS1f.js";
+import { a as PermDockUiContext, i as PermDockStoreContext, r as PermDockSnapshotPromiseContext } from "./live-options-BaAFCIiu.js";
 import { Suspense, use, useMemo, useSyncExternalStore } from "react";
 import { jsx } from "react/jsx-runtime";
 //#region src/react/hooks.ts
@@ -72,29 +72,41 @@ function useSubject() {
 	const permdock = usePermDock();
 	return useMemo(() => subjectView(permdock), [permdock]);
 }
+/** `describe` with the provider's `messages`; a call's own `messages` win. */
+function useDescribe() {
+	const { messages } = use(PermDockUiContext);
+	return useMemo(() => describeWith(messages), [messages]);
+}
 function useApproval(decision) {
 	return approvalHandle(storeOf(usePermDock()), decision);
 }
 //#endregion
 //#region src/react/protected.tsx
 function Protected(props) {
-	if (props.pending === void 0) return /* @__PURE__ */ jsx(Guard, { ...props });
+	const { defaults } = use(PermDockUiContext);
+	const pending = slotContent("pending", props, defaults);
+	if (pending === void 0) return /* @__PURE__ */ jsx(Guard, { ...props });
 	return /* @__PURE__ */ jsx(Suspense, {
-		fallback: props.pending,
+		fallback: pending,
 		children: /* @__PURE__ */ jsx(Guard, { ...props })
 	});
 }
 function Guard(props) {
+	const { defaults } = use(PermDockUiContext);
 	const root = usePermDock();
 	const local = usePermission(props.permission, props.data);
 	const scoped = useMemo(() => scopedTenant(root, props.tenant), [root, props.tenant]);
 	const view = protectedView(local, root, props.permission, props.data, scoped);
 	switch (view.slot) {
-		case "pending": return props.pending ?? null;
-		case "fallback": return typeof props.fallback === "function" ? props.fallback(view.decision) : props.fallback ?? null;
+		case "pending": return slotContent("pending", props, defaults) ?? null;
+		case "fallback": return render(slotContent("fallback", props, defaults), view.decision);
+		case "approval": return render(slotContent("approval", props, defaults), view.decision);
 		case "default": return typeof props.children === "function" ? props.children(view.decision) : props.children;
 		default: return view;
 	}
 }
+function render(content, decision) {
+	return typeof content === "function" ? content(decision) : content ?? null;
+}
 //#endregion
-export { useFilter as a, usePermission as c, useSubject as d, useTenant as f, useAssignableRoles as i, usePermissions as l, useApproval as n, useMemberships as o, useAssignablePermissions as r, usePermDock as s, Protected as t, useRoles as u };
+export { useDescribe as a, usePermDock as c, useRoles as d, useSubject as f, useAssignableRoles as i, usePermission as l, useApproval as n, useFilter as o, useTenant as p, useAssignablePermissions as r, useMemberships as s, Protected as t, usePermissions as u };

package/dist/{provider-CSQd7m92.js → provider-Bi-0HNL3.js}

@@ -1,8 +1,8 @@
-import { t as compact } from "./compact-y6vfu2_f.js";
-import { t as emptySnapshot } from "./from-snapshot-CTLijvdm.js";
-import { t as adapterStore } from "./store-options-ByhZq1jV.js";
-import { i as PermDockStoreContext, n as useKeyed, r as PermDockSnapshotPromiseContext, t as useLiveOptions } from "./live-options-H2eG8dfJ.js";
-import { useLayoutEffect } from "react";
+import { t as compact } from "./compact-CAf557ZB.js";
+import { t as emptySnapshot } from "./from-snapshot-7REQZe0H.js";
+import { t as adapterStore } from "./store-options-CbUHDoSe.js";
+import { a as PermDockUiContext, i as PermDockStoreContext, n as useKeyed, r as PermDockSnapshotPromiseContext, t as useLiveOptions } from "./live-options-BaAFCIiu.js";
+import { useLayoutEffect, useMemo } from "react";
 import { jsx } from "react/jsx-runtime";
 //#region src/react/provider.tsx
 function PermDockProvider(props) {
@@ -20,7 +20,10 @@ function PermDockProvider(props) {
 		maxAge: props.maxAge,
 		verifier: live.verifier,
 		awaiting,
-		passCache: true
+		passCache: true,
+		onSnapshot: live.onSnapshot,
+		onClear: live.onClear,
+		approvalInterval: props.approvalInterval
 	}), props.snapshot ?? emptySnapshot()), [
 		props.snapshot,
 		props.endpoint,
@@ -31,8 +34,15 @@ function PermDockProvider(props) {
 		live.headers,
 		props.maxAge,
 		live.verifier,
-		awaiting
+		awaiting,
+		live.onSnapshot,
+		live.onClear,
+		props.approvalInterval
 	]);
+	const ui = useMemo(() => ({
+		defaults: props.defaults,
+		messages: props.messages
+	}), [props.defaults, props.messages]);
 	useLayoutEffect(() => {
 		if (promise !== null && !suspend) store.track(promise);
 	}, [
@@ -42,9 +52,12 @@ function PermDockProvider(props) {
 	]);
 	return /* @__PURE__ */ jsx(PermDockStoreContext, {
 		value: store,
-		children: /* @__PURE__ */ jsx(PermDockSnapshotPromiseContext, {
-			value: suspend ? promise : null,
-			children: props.children
+		children: /* @__PURE__ */ jsx(PermDockUiContext, {
+			value: ui,
+			children: /* @__PURE__ */ jsx(PermDockSnapshotPromiseContext, {
+				value: suspend ? promise : null,
+				children: props.children
+			})
 		})
 	});
 }

package/dist/{provider-DZY281jO.d.ts → provider-kwHC9CZD.d.ts}

@@ -1,4 +1,4 @@
-import { t as PermDockProviderProps } from "./types-BnIEz1sU.js";
+import { n as PermDockProviderProps } from "./types-DHrmBJLH.js";
 import { ReactElement } from "react";
 //#region src/react/provider.d.ts
 declare function PermDockProvider(props: PermDockProviderProps): ReactElement;

package/dist/{provider-store-Cfbvo4DE.js → provider-store-Ctt-81Ni.js}

@@ -1,6 +1,6 @@
-import { t as compact } from "./compact-y6vfu2_f.js";
-import { t as emptySnapshot } from "./from-snapshot-CTLijvdm.js";
-import { i as isPromiseLike, t as adapterStore } from "./store-options-ByhZq1jV.js";
+import { t as compact } from "./compact-CAf557ZB.js";
+import { t as emptySnapshot } from "./from-snapshot-7REQZe0H.js";
+import { i as isPromiseLike, t as adapterStore } from "./store-options-CbUHDoSe.js";
 //#region src/client/provider-store.ts
 /**
 * Store options that read `read()` on every request, so a rotated token, a
@@ -30,6 +30,9 @@ function providerStore(options, read, snapshot) {
 		approvals: options.approvals,
 		tenant: options.tenant,
 		maxAge: options.maxAge,
+		onSnapshot: options.onSnapshot,
+		onClear: options.onClear,
+		approvalInterval: options.approvalInterval,
 		...liveOptions(read)
 	}), promised || snapshot === void 0 ? emptySnapshot() : snapshot);
 	if (promised) store.follow(snapshot);

package/dist/react/index.d.ts

@@ -1,8 +1,8 @@
-import { n as requiredPlans } from "../problem-details-DX075l9V.js";
-import { i as describe } from "../describe-DMYiCjJV.js";
+import { n as requiredPlans } from "../problem-details-rIIo8B2C.js";
+import { i as describe } from "../describe-C3ldA9os.js";
 import { t as approvalHeaders } from "../headers-Cf-zWvsO.js";
-import { a as FilterResult, c as SubjectView, i as ClientStatus, l as TenantView, n as ApprovalState, o as PermissionSet, r as ClientPermDock, s as PermissionState, t as ApprovalHandle } from "../types-CKNSyIf_.js";
-import { n as ProtectedProps, t as PermDockProviderProps } from "../types-BnIEz1sU.js";
-import { a as useFilter, c as usePermission, d as useSubject, f as useTenant, i as useAssignableRoles, l as usePermissions, n as useApproval, o as useMemberships, r as useAssignablePermissions, s as usePermDock, t as Protected, u as useRoles } from "../protected-BdnIEFkY.js";
-import { t as PermDockProvider } from "../provider-DZY281jO.js";
-export { type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type FilterResult, PermDockProvider, type PermDockProviderProps, type PermissionSet, type PermissionState, Protected, type ProtectedProps, type SubjectView, type TenantView, approvalHeaders, describe, requiredPlans, useApproval, useAssignablePermissions, useAssignableRoles, useFilter, useMemberships, usePermDock, usePermission, usePermissions, useRoles, useSubject, useTenant };
+import { a as ClientPermDock, c as PermissionSet, d as SubjectView, f as TenantView, i as ApprovalState, l as PermissionState, o as ClientStatus, r as ApprovalHandle, s as FilterResult } from "../store-9KO4BlkB.js";
+import { n as PermDockProviderProps, r as ProtectedProps, t as PermDockDefaults } from "../types-DHrmBJLH.js";
+import { a as useDescribe, c as usePermDock, d as useRoles, f as useSubject, i as useAssignableRoles, l as usePermission, n as useApproval, o as useFilter, p as useTenant, r as useAssignablePermissions, s as useMemberships, t as Protected, u as usePermissions } from "../protected-B3_P7xuw.js";
+import { t as PermDockProvider } from "../provider-kwHC9CZD.js";
+export { type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type FilterResult, type PermDockDefaults, PermDockProvider, type PermDockProviderProps, type PermissionSet, type PermissionState, Protected, type ProtectedProps, type SubjectView, type TenantView, approvalHeaders, describe, requiredPlans, useApproval, useAssignablePermissions, useAssignableRoles, useDescribe, useFilter, useMemberships, usePermDock, usePermission, usePermissions, useRoles, useSubject, useTenant };

package/dist/react/index.js

@@ -1,7 +1,7 @@
 "use client";
-import { r as requiredPlans } from "../problem-details-_AMOYz-w.js";
-import { t as describe } from "../describe-B_gVZEVi.js";
+import { r as requiredPlans } from "../problem-details-DECUnXAn.js";
+import { t as describe } from "../describe-Cgkp7eP0.js";
 import { t as approvalHeaders } from "../headers-BZSDieNT.js";
-import { a as useFilter, c as usePermission, d as useSubject, f as useTenant, i as useAssignableRoles, l as usePermissions, n as useApproval, o as useMemberships, r as useAssignablePermissions, s as usePermDock, t as Protected, u as useRoles } from "../protected-utU-SLuy.js";
-import { t as PermDockProvider } from "../provider-CSQd7m92.js";
-export { PermDockProvider, Protected, approvalHeaders, describe, requiredPlans, useApproval, useAssignablePermissions, useAssignableRoles, useFilter, useMemberships, usePermDock, usePermission, usePermissions, useRoles, useSubject, useTenant };
+import { a as useDescribe, c as usePermDock, d as useRoles, f as useSubject, i as useAssignableRoles, l as usePermission, n as useApproval, o as useFilter, p as useTenant, r as useAssignablePermissions, s as useMemberships, t as Protected, u as usePermissions } from "../protected-BN7BUdY1.js";
+import { t as PermDockProvider } from "../provider-Bi-0HNL3.js";
+export { PermDockProvider, Protected, approvalHeaders, describe, requiredPlans, useApproval, useAssignablePermissions, useAssignableRoles, useDescribe, useFilter, useMemberships, usePermDock, usePermission, usePermissions, useRoles, useSubject, useTenant };

package/dist/react/provider-client.d.ts

@@ -1,2 +1,2 @@
-import { t as PermDockProvider } from "../provider-DZY281jO.js";
+import { t as PermDockProvider } from "../provider-kwHC9CZD.js";
 export { PermDockProvider };

package/dist/react/provider-client.js

@@ -1,3 +1,3 @@
 "use client";
-import { t as PermDockProvider } from "../provider-CSQd7m92.js";
+import { t as PermDockProvider } from "../provider-Bi-0HNL3.js";
 export { PermDockProvider };

package/dist/react-native/index.d.ts

@@ -1,13 +1,12 @@
-import { At as SnapshotSource, Dr as CustomRole, Ft as TokenVerifier, Mr as Membership, Tt as Snapshot, pt as LocalSnapshotManifest } from "../policy-IB6yxpC3.js";
-import { f as Permission } from "../permissions-DttnqqxC.js";
-import { n as requiredPlans } from "../problem-details-DX075l9V.js";
-import { i as describe } from "../describe-DMYiCjJV.js";
-import { t as parseLocalSnapshotManifest } from "../parse-local-manifest-JLnaBH0S.js";
+import { Dr as Membership, Sr as CustomRole, an as Snapshot, at as SnapshotSource, in as LocalSnapshotManifest, ut as TokenVerifier } from "../policy-types-sp9P1iIV.js";
+import { d as Permission } from "../permission-types-Dg39z9Kv.js";
+import { n as requiredPlans } from "../problem-details-rIIo8B2C.js";
+import { i as describe, n as DescribeMessages } from "../describe-C3ldA9os.js";
+import { t as parseLocalSnapshotManifest } from "../parse-local-manifest-DvYUR0QL.js";
 import { t as approvalHeaders } from "../headers-Cf-zWvsO.js";
-import { a as FilterResult, c as SubjectView, i as ClientStatus, l as TenantView, n as ApprovalState, o as PermissionSet, r as ClientPermDock, s as PermissionState, t as ApprovalHandle } from "../types-CKNSyIf_.js";
-import { n as ProtectedProps } from "../types-BnIEz1sU.js";
-import { a as useFilter, c as usePermission, d as useSubject, f as useTenant, i as useAssignableRoles, l as usePermissions, n as useApproval, o as useMemberships, r as useAssignablePermissions, s as usePermDock, t as Protected, u as useRoles } from "../protected-BdnIEFkY.js";
-import { t as ClientStore } from "../store-jOBYpiXC.js";
+import { a as ClientPermDock, c as PermissionSet, d as SubjectView, f as TenantView, i as ApprovalState, l as PermissionState, n as ClientStoreOptions, o as ClientStatus, r as ApprovalHandle, s as FilterResult, t as ClientStore } from "../store-9KO4BlkB.js";
+import { r as ProtectedProps, t as PermDockDefaults } from "../types-DHrmBJLH.js";
+import { a as useDescribe, c as usePermDock, d as useRoles, f as useSubject, i as useAssignableRoles, l as usePermission, n as useApproval, o as useFilter, p as useTenant, r as useAssignablePermissions, s as useMemberships, t as Protected, u as usePermissions } from "../protected-B3_P7xuw.js";
 import { ReactElement, ReactNode } from "react";
 //#region src/react-native/guards.d.ts
 /** `true` once the provider has a snapshot to answer from: storage was read or a seed was given. Hide the splash screen on it. */
@@ -123,6 +122,16 @@ type NativePermDockProviderProps = {
   readonly headers?: Readonly<Record<string, string>>;
   readonly maxAge?: number;
   readonly verifier?: TokenVerifier;
+  /** What every `<Protected>` below renders for a slot it leaves out. */
+  readonly defaults?: PermDockDefaults;
+  /** Localised text for `useDescribe()`. */
+  readonly messages?: DescribeMessages;
+  /** Called with each snapshot the store accepts, after it is persisted. */
+  readonly onSnapshot?: NonNullable<ClientStoreOptions["onSnapshot"]>;
+  /** Called when the store drops its snapshot, after storage is cleared. */
+  readonly onClear?: () => void;
+  /** Milliseconds between approval status polls. Defaults to 2000. */
+  readonly approvalInterval?: number;
   readonly children: ReactNode;
 };
 //#endregion
@@ -181,7 +190,7 @@ export declare function appStateForeground(appState: AppStateModule): SubscribeF
 export declare function netInfoOnline(netInfo: NetInfoModule): SubscribeOnline;
 //#endregion
 //#region src/react-native/store.d.ts
-type NativeStoreOptions = Omit<NativePermDockProviderProps, "children" | "headers"> & {
+type NativeStoreOptions = Omit<NativePermDockProviderProps, "children" | "headers" | "defaults" | "messages"> & {
   readonly headers?: Readonly<Record<string, string>> | (() => Readonly<Record<string, string>> | undefined);
   /** A store this one replaces: its snapshot and tenant seed this store, so guards do not flip while it boots. */
   readonly previous?: ClientStore;
@@ -195,4 +204,4 @@ type NativeStoreOptions = Omit<NativePermDockProviderProps, "children" | "header
 export declare function connectSource(store: ClientStore, source: SnapshotSource, subscribeForeground?: SubscribeForeground): () => void;
 export declare function createNativeStore(options: NativeStoreOptions): ClientStore;
 //#endregion
-export { type AppStateModule, type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type FilterResult, type LocalSnapshotData, type LocalSnapshotManifest, type LocalSnapshotOptions, type MmkvInstance, type NativePermDockProviderProps, type NativeRevalidate, type NetInfoModule, type PermDockStorage, type PermissionSet, type PermissionState, type PowerSyncQuery, type PowerSyncSourceOptions, type PowerSyncWatchable, Protected, type ProtectedProps, type SecureStoreModule, type SnapshotSource, type SubjectView, type SubscribeForeground, type SubscribeOnline, type TenantView, approvalHeaders, describe, parseLocalSnapshotManifest, requiredPlans, useApproval, useAssignablePermissions, useAssignableRoles, useFilter, useMemberships, usePermDock, usePermission, usePermissions, useRoles, useSubject, useTenant };
+export { type AppStateModule, type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type FilterResult, type LocalSnapshotData, type LocalSnapshotManifest, type LocalSnapshotOptions, type MmkvInstance, type NativePermDockProviderProps, type NativeRevalidate, type NetInfoModule, type PermDockDefaults, type PermDockStorage, type PermissionSet, type PermissionState, type PowerSyncQuery, type PowerSyncSourceOptions, type PowerSyncWatchable, Protected, type ProtectedProps, type SecureStoreModule, type SnapshotSource, type SubjectView, type SubscribeForeground, type SubscribeOnline, type TenantView, approvalHeaders, describe, parseLocalSnapshotManifest, requiredPlans, useApproval, useAssignablePermissions, useAssignableRoles, useDescribe, useFilter, useMemberships, usePermDock, usePermission, usePermissions, useRoles, useSubject, useTenant };

package/dist/react-native/index.js

@@ -1,19 +1,19 @@
 "use client";
-import { t as compact } from "../compact-y6vfu2_f.js";
+import { t as compact } from "../compact-CAf557ZB.js";
 import { n as freezeDeep } from "../freeze-CrU8nQeX.js";
-import { r as requiredPlans } from "../problem-details-_AMOYz-w.js";
-import { t as describe } from "../describe-B_gVZEVi.js";
-import { a as normalizeMemberships, d as scopeList, m as tenantOf$1, o as resolveScope } from "../scopes-CVdPrWN-.js";
-import { n as parseSnapshot, o as bindConditionRefs } from "../snapshot-Enxd0n-s.js";
-import { s as flattenGrantee } from "../grantee-Cv5Sogfv.js";
-import { p as resolveActiveTenant, u as nowSeconds } from "../validity-uOp8UpYn.js";
-import { n as isThenable } from "../thenable-okc2xDsj.js";
-import { r as heldRoleNames, t as emptySnapshot } from "../from-snapshot-CTLijvdm.js";
-import { t as parseLocalSnapshotManifest } from "../parse-local-manifest-BrMozJCo.js";
+import { n as isThenable } from "../thenable-QSmvt-vZ.js";
+import { r as requiredPlans } from "../problem-details-DECUnXAn.js";
+import { t as describe } from "../describe-Cgkp7eP0.js";
+import { a as normalizeMemberships, d as scopeList, m as tenantOf$1, o as resolveScope } from "../scopes-tvpa34ep.js";
+import { n as parseSnapshot, o as bindConditionRefs } from "../snapshot-Dc9CHPME.js";
+import { o as flattenGrantee } from "../grantee-CXY-0C87.js";
+import { c as nowSeconds, d as resolveActiveTenant } from "../tenancy-DshjqY0n.js";
+import { r as heldRoleNames, t as emptySnapshot } from "../from-snapshot-7REQZe0H.js";
+import { t as parseLocalSnapshotManifest } from "../parse-local-manifest-C-q02Pal.js";
 import { t as approvalHeaders } from "../headers-BZSDieNT.js";
-import { n as storeOf, r as isJws, t as adapterStore } from "../store-options-ByhZq1jV.js";
-import { i as PermDockStoreContext, n as useKeyed, t as useLiveOptions } from "../live-options-H2eG8dfJ.js";
-import { a as useFilter, c as usePermission, d as useSubject, f as useTenant, i as useAssignableRoles, l as usePermissions, n as useApproval, o as useMemberships, r as useAssignablePermissions, s as usePermDock, t as Protected, u as useRoles } from "../protected-utU-SLuy.js";
+import { n as storeOf, r as isJws, t as adapterStore } from "../store-options-CbUHDoSe.js";
+import { a as PermDockUiContext, i as PermDockStoreContext, n as useKeyed, t as useLiveOptions } from "../live-options-BaAFCIiu.js";
+import { a as useDescribe, c as usePermDock, d as useRoles, f as useSubject, i as useAssignableRoles, l as usePermission, n as useApproval, o as useFilter, p as useTenant, r as useAssignablePermissions, s as useMemberships, t as Protected, u as usePermissions } from "../protected-BN7BUdY1.js";
 import { useEffect, useMemo, useRef } from "react";
 import { jsx } from "react/jsx-runtime";
 //#region src/react-native/guards.ts
@@ -447,7 +447,10 @@ function createNativeStore(options) {
 		maxAge: options.maxAge,
 		verifier: options.verifier,
 		awaiting: waiting,
-		passCache: true
+		passCache: true,
+		onSnapshot: options.onSnapshot,
+		onClear: options.onClear,
+		approvalInterval: options.approvalInterval
 	}), snapshot, {
 		server: false,
 		stale: revalidates && (fromStorage !== void 0 || waiting),
@@ -498,6 +501,9 @@ function PermDockProvider(props) {
 		headers: live.readHeaders,
 		maxAge: props.maxAge,
 		verifier: live.verifier,
+		onSnapshot: live.onSnapshot,
+		onClear: live.onClear,
+		approvalInterval: props.approvalInterval,
 		previous: shown.current ?? void 0
 	})), [
 		props.storage,
@@ -510,8 +516,15 @@ function PermDockProvider(props) {
 		props.tenant,
 		live.fetch,
 		props.maxAge,
-		live.verifier
+		live.verifier,
+		live.onSnapshot,
+		live.onClear,
+		props.approvalInterval
 	]);
+	const ui = useMemo(() => ({
+		defaults: props.defaults,
+		messages: props.messages
+	}), [props.defaults, props.messages]);
 	useEffect(() => {
 		const previous = shown.current;
 		shown.current = store;
@@ -580,7 +593,10 @@ function PermDockProvider(props) {
 	]);
 	return /* @__PURE__ */ jsx(PermDockStoreContext, {
 		value: store,
-		children: props.children
+		children: /* @__PURE__ */ jsx(PermDockUiContext, {
+			value: ui,
+			children: props.children
+		})
 	});
 }
 //#endregion
@@ -693,4 +709,4 @@ function netInfoOnline(netInfo) {
 	});
 }
 //#endregion
-export { PermDockProvider, Protected, appStateForeground, approvalHeaders, buildLocalSnapshot, connectSource, createNativeStore, describe, localSnapshot, memoryStorage, mmkvStorage, netInfoOnline, parseLocalSnapshotManifest, powersyncSource, requiredPlans, secureStoreStorage, useApproval, useAssignablePermissions, useAssignableRoles, useFilter, useMemberships, usePermDock, usePermission, usePermissionGuard, usePermissions, useRoles, useSnapshotReady, useSubject, useTenant };
+export { PermDockProvider, Protected, appStateForeground, approvalHeaders, buildLocalSnapshot, connectSource, createNativeStore, describe, localSnapshot, memoryStorage, mmkvStorage, netInfoOnline, parseLocalSnapshotManifest, powersyncSource, requiredPlans, secureStoreStorage, useApproval, useAssignablePermissions, useAssignableRoles, useDescribe, useFilter, useMemberships, usePermDock, usePermission, usePermissionGuard, usePermissions, useRoles, useSnapshotReady, useSubject, useTenant };

package/dist/{refs-KYb4ntaz.js → refs-f3imMjNW.js}

@@ -1,5 +1,5 @@
 import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { O as readPath, k as splitPath, w as assertSafeKey } from "./permissions-DVoF6dMt.js";
+import { a as assertSafeKey, l as readPath, u as splitPath } from "./thenable-QSmvt-vZ.js";
 //#region src/conditions/ast.ts
 function parentHop(parent) {
 	return typeof parent === "string" ? { field: parent } : parent;