permdock 0.6.0 → 0.8.0

package/dist/protected-action-BE7N_Luo.d.ts

@@ -0,0 +1,58 @@
+import { Ln as Decision, j as PolicyVocabulary, or as Membership } from "./policy-types-CCiDRZBH.js";
+import { u as Permission } from "./permission-types-CAY-GU7e.js";
+import { r as Role } from "./vocabulary-DEJ5j4mR.js";
+import { d as UncheckedData, s as RowData } from "./permdock-B6Sf4T_S.js";
+import { r as DescribeOptions, t as DecisionDescription } from "./describe-ByS9LgHK.js";
+import { n as ProtectedAction } from "./action-result-CL-QCITA.js";
+import { a as FilterResult, c as PermissionSet, h as TenantView, l as PermissionState, m as SubjectView, o as GateMode, p as RolesOptions, r as ClientPermDock, s as GateView, t as ApprovalHandle, u as ProtectedActionHandle } from "./types-B_d_g7T3.js";
+import { r as ProtectedProps } from "./types-BJk0BKRX.js";
+import { ReactNode } from "react";
+//#region src/react/hooks.d.ts
+declare function usePermDock<V extends PolicyVocabulary = PolicyVocabulary>(): ClientPermDock<V>;
+declare function usePermission<D>(permission: Permission, data?: UncheckedData<D>): PermissionState;
+declare function usePermission<P extends Permission>(permission: P, data?: RowData<P>): PermissionState;
+declare function usePermissions(permissions: readonly Permission[], data?: unknown): PermissionSet;
+declare function useFilter<T>(permission: Permission<string, NoInfer<T>, "instance">, rows: readonly T[]): FilterResult<T>;
+declare function useTenant(): TenantView;
+declare function useMemberships(): readonly Membership[];
+declare function useRoles(options?: RolesOptions): {
+  readonly roles: readonly Role[];
+};
+declare function useAssignableRoles(): readonly Role[];
+declare function useAssignablePermissions(options?: {
+  readonly tenant?: string;
+}): readonly Permission[];
+declare function useSubject(): SubjectView;
+/** `describe` with the provider's `messages`; a call's own `messages` win. */
+declare function useDescribe(): (decision: Decision, options?: DescribeOptions) => DecisionDescription;
+declare function useApproval(decision: Decision): ApprovalHandle;
+/**
+ * What a permission-gated control renders: `hidden`, `disabled`,
+ * `needsApproval`, `upgrade` and a localised `reason`, from the same snapshot
+ * as `usePermission`. React and React Native share it; a recipe renders the
+ * fields and decides nothing.
+ */
+declare function useGate<D>(permission: Permission, data?: UncheckedData<D>, options?: {
+  readonly mode?: GateMode;
+}): GateView;
+declare function useGate<P extends Permission>(permission: P, data?: RowData<P>, options?: {
+  readonly mode?: GateMode;
+}): GateView;
+//#endregion
+//#region src/react/protected.d.ts
+declare function Protected<P extends Permission>(props: ProtectedProps<P>): ReactNode;
+//#endregion
+//#region src/react/protected-action.d.ts
+/**
+ * A `protectAction` server action wired to a control: `gate` for the button,
+ * `run(input)` and its `result`, and on an `approval-required` problem the
+ * `approval` handle plus `retry()`, which resends with the token.
+ */
+declare function useProtectedAction<T, D>(action: ProtectedAction<T>, permission: Permission, data?: UncheckedData<D>, options?: {
+  readonly mode?: GateMode;
+}): ProtectedActionHandle<T>;
+declare function useProtectedAction<T, P extends Permission>(action: ProtectedAction<T>, permission: P, data?: RowData<P>, options?: {
+  readonly mode?: GateMode;
+}): ProtectedActionHandle<T>;
+//#endregion
+export { useAssignableRoles as a, useGate as c, usePermission as d, usePermissions as f, useTenant as h, useAssignablePermissions as i, useMemberships as l, useSubject as m, Protected as n, useDescribe as o, useRoles as p, useApproval as r, useFilter as s, useProtectedAction as t, usePermDock as u };

package/dist/protected-action-DUYqb-Ma.js

@@ -0,0 +1,80 @@
+import { a as problemType } from "./problem-details-CLDgX1KV.js";
+import { t as approvalHeaderValue } from "./approval-header-8QV6MU4H.js";
+import { t as approvalHandle } from "./views-CD8wuL4Z.js";
+//#region src/client/headers.ts
+/**
+* The `PermDock-Approval` header for a resume; a `TypeError` for a token that
+* is not an RFC 9651 sf-token.
+*/
+function approvalHeaders(token) {
+	return { "PermDock-Approval": approvalHeaderValue(token) };
+}
+//#endregion
+//#region src/client/protected-action.ts
+function approvalToken(result) {
+	return result === void 0 || result.ok || result.problem.type !== problemType("approval-required") ? void 0 : result.problem.token;
+}
+/**
+* Calls a protected server action and reports its state through `set`. Only the
+* latest call's answer lands; a throw (a Next.js redirect, a network failure)
+* clears `pending` and propagates.
+*/
+function actionRunner(read, set) {
+	let result;
+	let last;
+	let seq = 0;
+	const call = async (input, options) => {
+		seq += 1;
+		const mine = seq;
+		last = { input };
+		set({
+			result,
+			pending: true
+		});
+		try {
+			const next = await read()(input, options);
+			if (mine === seq) {
+				result = next;
+				set({
+					result,
+					pending: false
+				});
+			}
+			return next;
+		} catch (error) {
+			if (mine === seq) set({
+				result,
+				pending: false
+			});
+			throw error;
+		}
+	};
+	return {
+		run: (input) => call(input, void 0),
+		retry: () => {
+			const token = approvalToken(result);
+			return last === void 0 || token === void 0 ? Promise.resolve(void 0) : call(last.input, { approval: token });
+		}
+	};
+}
+/**
+* The approval handle for an `approval-required` problem; `undefined` for any
+* other result. The decision is rebuilt from the problem only to poll and
+* request its token: the server decides again on `retry`.
+*/
+function actionApproval(store, result) {
+	const token = approvalToken(result);
+	const permission = result === void 0 || result.ok ? void 0 : result.problem.permission;
+	if (token === void 0 || permission === void 0) return;
+	return approvalHandle(store, {
+		outcome: "approval-required",
+		grant: {
+			role: null,
+			permission
+		},
+		reason: "human",
+		token
+	});
+}
+//#endregion
+export { actionRunner as n, approvalHeaders as r, actionApproval as t };

package/dist/{protected-BlF0F6wL.js → protected-action-QEA8arRB.js}

@@ -1,7 +1,8 @@
-import { n as storeOf } from "./store-options-u0ycEe8s.js";
-import { c as rolesView, d as subjectView, f as tenantView, i as gateView, l as scopedTenant, n as describeWith, o as permissionSet, r as filterResult, s as protectedView, t as approvalHandle, u as slotContent } from "./views-DTIIO-oQ.js";
-import { a as PermDockUiContext, i as PermDockStoreContext, r as PermDockSnapshotPromiseContext } from "./live-options-BaAFCIiu.js";
-import { Suspense, use, useMemo, useSyncExternalStore } from "react";
+import { n as actionRunner, t as actionApproval } from "./protected-action-DUYqb-Ma.js";
+import { c as rolesView, d as subjectView, f as tenantView, i as gateView, l as scopedTenant, n as describeWith, o as permissionSet, r as filterResult, s as protectedView, t as approvalHandle, u as slotContent } from "./views-CD8wuL4Z.js";
+import { n as storeOf } from "./store-options-Dil3lraY.js";
+import { a as PermDockUiContext, i as PermDockStoreContext, r as PermDockSnapshotPromiseContext } from "./live-options-BBIT68le.js";
+import { Suspense, use, useLayoutEffect, useMemo, useState, useSyncExternalStore } from "react";
 import { jsx } from "react/jsx-runtime";
 //#region src/react/hooks.ts
 function useStore() {
@@ -49,14 +50,16 @@ function useMemberships() {
 }
 function useRoles(options = {}) {
 	const permdock = usePermDock();
-	const { tenant, team } = options;
+	const { tenant, scope, id } = options;
 	return useMemo(() => rolesView(permdock, {
 		...tenant === void 0 ? {} : { tenant },
-		...team === void 0 ? {} : { team }
+		...scope === void 0 ? {} : { scope },
+		...id === void 0 ? {} : { id }
 	}), [
 		permdock,
 		tenant,
-		team
+		scope,
+		id
 	]);
 }
 function useAssignableRoles() {
@@ -80,12 +83,6 @@ function useDescribe() {
 function useApproval(decision) {
 	return approvalHandle(storeOf(usePermDock()), decision);
 }
-/**
-* What a permission-gated control renders: `hidden`, `disabled`,
-* `needsApproval`, `upgrade` and a localised `reason`, from the same
-* snapshot as `usePermission`. React and React Native share it; a recipe
-* renders the fields and decides nothing.
-*/
 function useGate(permission, data, options = {}) {
 	const state = usePermission(permission, data);
 	const describeDecision = useDescribe();
@@ -126,4 +123,41 @@ function render(content, decision) {
 	return typeof content === "function" ? content(decision) : content ?? null;
 }
 //#endregion
-export { useDescribe as a, useMemberships as c, usePermissions as d, useRoles as f, useAssignableRoles as i, usePermDock as l, useTenant as m, useApproval as n, useFilter as o, useSubject as p, useAssignablePermissions as r, useGate as s, Protected as t, usePermission as u };
+//#region src/react/protected-action.ts
+function useProtectedAction(action, permission, data, options = {}) {
+	const gate = useGate(permission, data, options);
+	const store = storeOf(usePermDock());
+	const [state, setState] = useState({
+		result: void 0,
+		pending: false
+	});
+	const [cell] = useState(() => {
+		let current = action;
+		return {
+			follow: (next) => {
+				current = next;
+			},
+			runner: actionRunner(() => current, setState)
+		};
+	});
+	useLayoutEffect(() => {
+		cell.follow(action);
+	});
+	const { runner } = cell;
+	const approval = actionApproval(store, state.result);
+	return useMemo(() => ({
+		gate,
+		result: state.result,
+		pending: state.pending,
+		approval,
+		run: runner.run,
+		retry: runner.retry
+	}), [
+		gate,
+		state,
+		approval,
+		runner
+	]);
+}
+//#endregion
+export { useAssignableRoles as a, useGate as c, usePermission as d, usePermissions as f, useTenant as h, useAssignablePermissions as i, useMemberships as l, useSubject as m, Protected as n, useDescribe as o, useRoles as p, useApproval as r, useFilter as s, useProtectedAction as t, usePermDock as u };

package/dist/{provider-B1al-AZz.js → provider-C55OGXJ7.js}

@@ -1,7 +1,7 @@
 import { t as compact } from "./compact-CAf557ZB.js";
-import { t as emptySnapshot } from "./from-snapshot-CTCMsFZk.js";
-import { t as adapterStore } from "./store-options-u0ycEe8s.js";
-import { a as PermDockUiContext, i as PermDockStoreContext, n as useKeyed, r as PermDockSnapshotPromiseContext, t as useLiveOptions } from "./live-options-BaAFCIiu.js";
+import { t as emptySnapshot } from "./from-snapshot-DCakWRsr.js";
+import { t as adapterStore } from "./store-options-Dil3lraY.js";
+import { a as PermDockUiContext, i as PermDockStoreContext, n as useKeyed, r as PermDockSnapshotPromiseContext, t as useLiveOptions } from "./live-options-BBIT68le.js";
 import { useLayoutEffect, useMemo } from "react";
 import { jsx } from "react/jsx-runtime";
 //#region src/react/provider.tsx
@@ -23,7 +23,8 @@ function PermDockProvider(props) {
 		passCache: true,
 		onSnapshot: live.onSnapshot,
 		onClear: live.onClear,
-		approvalInterval: props.approvalInterval
+		approvalInterval: props.approvalInterval,
+		refreshOn: props.refreshOn
 	}), props.snapshot ?? emptySnapshot()), [
 		props.snapshot,
 		props.endpoint,

package/dist/{provider-DILL9oPK.d.ts → provider-DXfq5c2d.d.ts}

@@ -1,4 +1,4 @@
-import { n as PermDockProviderProps } from "./types-CX7AvRqP.js";
+import { n as PermDockProviderProps } from "./types-BJk0BKRX.js";
 import { ReactElement } from "react";
 //#region src/react/provider.d.ts
 declare function PermDockProvider(props: PermDockProviderProps): ReactElement;

package/dist/{provider-store-DM6DNcta.js → provider-store-CaTv00tr.js}

@@ -1,12 +1,12 @@
 import { t as compact } from "./compact-CAf557ZB.js";
-import { t as emptySnapshot } from "./from-snapshot-CTCMsFZk.js";
-import { i as isPromiseLike, t as adapterStore } from "./store-options-u0ycEe8s.js";
+import { t as emptySnapshot } from "./from-snapshot-DCakWRsr.js";
+import { a as isPromiseLike, t as adapterStore } from "./store-options-Dil3lraY.js";
 //#region src/client/provider-store.ts
 /**
-* Store options that read `read()` on every request, so a rotated token, a
-* new `fetch` or a new verifier applies without rebuilding the store. A
-* verifier is wired only when one is present at creation: it switches the
-* store to signed snapshots.
+* Store options that read `read()` on every request, so a rotated token, a new
+* `fetch` or a new verifier applies without rebuilding the store. A verifier is
+* wired only when one is present at creation: it switches the store to signed
+* snapshots.
 */
 function liveOptions(read) {
 	return compact({
@@ -19,8 +19,8 @@ function liveOptions(read) {
 	});
 }
 /**
-* The store a Vue, Svelte or Solid provider owns. A promised snapshot keeps
-* it `pending` until the promise settles; `undefined` starts empty.
+* The store a Vue, Svelte or Solid provider owns. A promised snapshot keeps it
+* `pending` until the promise settles; `undefined` starts empty.
 */
 function providerStore(options, read, snapshot) {
 	const promised = isPromiseLike(snapshot);
@@ -33,12 +33,16 @@ function providerStore(options, read, snapshot) {
 		onSnapshot: options.onSnapshot,
 		onClear: options.onClear,
 		approvalInterval: options.approvalInterval,
+		refreshOn: options.refreshOn,
 		...liveOptions(read)
 	}), promised || snapshot === void 0 ? emptySnapshot() : snapshot);
 	if (promised) store.follow(snapshot);
 	return store;
 }
-/** Refreshes for the tenant a reactive `tenant` option switched to; a failed refresh keeps the current answers. */
+/**
+* Refreshes for the tenant a reactive `tenant` option switched to; a failed
+* refresh keeps the current answers.
+*/
 function switchTenant(store, tenant) {
 	if (tenant !== void 0) store.get().refresh({ tenant }).catch(() => void 0);
 }

package/dist/pull-B65ndFNZ.js

@@ -0,0 +1 @@
+export { n as runCloudPull } from "./pull-CwpGaQSi.js";

package/dist/{pull-jEwbf80J.js → pull-CwpGaQSi.js}

@@ -1,15 +1,16 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
-import { t as catalogFingerprint } from "./catalog-fingerprint-CCP0-yQS.js";
-import { a as describeError } from "./errors-CWTY6uih.js";
-import { s as writeFileEnsuringDir } from "./files-D_JIzUrP.js";
-import { s as cliVersion } from "./version-CEbQ5UeM.js";
-import { a as formatCatalogJson } from "./catalog-doc-Cdn7-0pQ.js";
+import { t as catalogFingerprint } from "./catalog-fingerprint-e6aCWosn.js";
+import { a as describeError } from "./errors-Vpu6rKHl.js";
+import { s as writeFileEnsuringDir } from "./files-BSjrtIHw.js";
+import { s as cliVersion } from "./version-DMQ0dnN5.js";
+import { o as formatCatalogJson } from "./catalog-doc-DjMKzJp9.js";
 import { t as catalogPath } from "./catalog-path-CnI0XTFK.js";
-import { t as parseSupabaseManifest } from "./manifest-C8IzW3Do.js";
-import { t as parseCatalog } from "./parse-Cxq0WxrA.js";
-import { t as POLICY_NOT_PUBLISHED } from "./problem-types-CJ2325SZ.js";
-import { n as httpRequest, t as authFailure } from "./http-DXJ37RDA.js";
-import { l as cloudUrl, n as cliRuntime, o as readAuth } from "./auth-DRLEizbL.js";
+import { n as parseSupabaseManifest } from "./manifest-wg8WkkpD.js";
+import { t as parseCatalog } from "./parse-1_ZheTW5.js";
+import { a as nonEmptyOr } from "./output-tkju6U7R.js";
+import { t as POLICY_NOT_PUBLISHED } from "./problem-types-DSsRfONQ.js";
+import { n as httpRequest, t as authFailure } from "./http-DOL33cO0.js";
+import { l as cloudUrl, n as cliRuntime, o as readAuth } from "./auth--yPyZNgr.js";
 import { n as formatManifestJson } from "./manifest-json-CAGzls-C.js";
 import { existsSync, readFileSync, rmSync } from "node:fs";
 import { relative, resolve } from "node:path";
@@ -232,7 +233,7 @@ async function runCloudPull(input) {
 		restore(before);
 		return {
 			code: 1,
-			output: `${COMMAND}: catalog fingerprint mismatch (Cloud ${pulled.fingerprint}, catalog ${catalog.fingerprint ?? "none"}, written ${written || "unreadable"}); restored the previous files`
+			output: `${COMMAND}: catalog fingerprint mismatch (Cloud ${pulled.fingerprint}, catalog ${catalog.fingerprint ?? "none"}, written ${nonEmptyOr(written, "unreadable")}); restored the previous files`
 		};
 	}
 	const local = cliVersion();

package/dist/{push-BD4f15co.js → push-DgssgzkK.js}

@@ -1,18 +1,23 @@
-import { t as catalogFingerprint } from "./catalog-fingerprint-CCP0-yQS.js";
-import { a as describeError } from "./errors-CWTY6uih.js";
-import { s as cliVersion } from "./version-CEbQ5UeM.js";
-import { i as loadConfiguredPolicy } from "./load-DFS_ry0W.js";
-import { t as parseSupabaseManifest } from "./manifest-C8IzW3Do.js";
-import { t as parseCatalog } from "./parse-Cxq0WxrA.js";
-import { r as pushedPolicy } from "./pushed-policy-CqtxkV4G.js";
-import { n as runCatalog } from "./catalog-HD2gf5mY.js";
-import { n as httpRequest, t as authFailure } from "./http-DXJ37RDA.js";
-import { a as pushAuth, l as cloudUrl, n as cliRuntime, u as firstNonEmpty } from "./auth-DRLEizbL.js";
+import { r as isRecord } from "./compact-CAf557ZB.js";
+import { n as PermDockValidationError } from "./validation-error-CYg2kJEw.js";
+import { t as catalogFingerprint } from "./catalog-fingerprint-e6aCWosn.js";
+import { a as describeError, n as CliError } from "./errors-Vpu6rKHl.js";
+import { s as cliVersion } from "./version-DMQ0dnN5.js";
+import { i as loadConfiguredPolicy } from "./load-DjSU5KXO.js";
+import { n as parseSupabaseManifest } from "./manifest-wg8WkkpD.js";
+import { t as parseCatalog } from "./parse-1_ZheTW5.js";
+import { r as pushedPolicy } from "./pushed-policy-ITwYKvvH.js";
+import { n as runCatalog } from "./catalog-BFpz2EmT.js";
+import { n as httpRequest, t as authFailure } from "./http-DOL33cO0.js";
+import { a as pushAuth, l as cloudUrl, n as cliRuntime, u as firstNonEmpty } from "./auth--yPyZNgr.js";
 import "./manifest-json-CAGzls-C.js";
 import { existsSync, readFileSync } from "node:fs";
 import { resolve } from "node:path";
 //#region src/cli/cloud/push.ts
-/** `--manifest`, else `permdock.manifest.json` when it exists; a file that does not parse is an error. */
+/**
+* `--manifest`, else `permdock.manifest.json` when it exists; a file that does
+* not parse is an error.
+*/
 function readManifest(cwd, flag) {
 	const path = resolve(cwd, flag ?? "permdock.manifest.json");
 	if (!existsSync(path)) return flag === void 0 ? {
@@ -34,6 +39,46 @@ function readManifest(cwd, flag) {
 		};
 	}
 }
+/**
+* The built catalog, or a `catalog_invalid` problem listing every issue with
+* its path.
+*/
+function checkedCatalog(output) {
+	try {
+		return parseCatalog(output);
+	} catch (error) {
+		if (!(error instanceof PermDockValidationError)) throw error;
+		const issues = error.issues.map((issue) => ({
+			path: (issue.path ?? []).map(String).join("."),
+			message: issue.message
+		}));
+		throw new CliError("failed", [`permdock cloud push: the catalog has ${String(issues.length)} ${issues.length === 1 ? "issue" : "issues"}`, ...issues.map((issue) => `  ${issue.path}: ${issue.message}`)].join("\n"), {
+			code: "catalog_invalid",
+			extensions: { issues }
+		});
+	}
+}
+/** The environment `GET /v1/environment` names for the push credential. */
+async function keyEnvironment(io, url, bearer) {
+	const response = await httpRequest(io, {
+		url: `${url}/v1/environment`,
+		service: "PermDock Cloud",
+		headers: {
+			authorization: `Bearer ${bearer}`,
+			accept: "application/json"
+		}
+	});
+	const body = response.ok ? await response.json().catch(() => void 0) : void 0;
+	const environment = isRecord(body) ? body["environment"] : void 0;
+	if (typeof environment === "string" && environment !== "") return environment;
+	throw new CliError("failed", `permdock cloud push: PermDock Cloud did not name the credential's environment (HTTP ${String(response.status)})`, { next: [{
+		command: "permdock cloud push --project <environment>",
+		when: "to name the environment"
+	}, {
+		command: "export PERMDOCK_CLOUD_ENV=<environment>",
+		when: "in CI"
+	}] });
+}
 async function runCloud(input) {
 	const manifest = readManifest(input.cwd, input.manifest);
 	if (!manifest.ok) return {
@@ -53,7 +98,7 @@ async function runCloud(input) {
 		code: built.code,
 		output: built.output
 	};
-	const catalog = parseCatalog(built.output);
+	const catalog = checkedCatalog(built.output);
 	const fingerprint = catalogFingerprint(catalog);
 	const loaded = await loadConfiguredPolicy(input.cwd, input.config.policy);
 	const policy = loaded === void 0 ? void 0 : pushedPolicy(loaded);
@@ -68,17 +113,18 @@ async function runCloud(input) {
 		manifest: manifest.manifest !== void 0
 	};
 	const url = cloudUrl(input.url, input.env);
-	const environment = firstNonEmpty(input.project, input.env["PERMDOCK_CLOUD_ENV"], input.env["VERCEL_ENV"], "production");
-	const describe = (verb) => input.json ? JSON.stringify({
+	const configured = firstNonEmpty(input.project, input.env["PERMDOCK_CLOUD_ENV"]);
+	const describe = (verb, environment) => input.json ? JSON.stringify({
 		...summary,
 		environment,
 		status: verb
 	}) : `${verb} catalog ${fingerprint} (${String(summary.permissions)} permissions, ${String(hostable.length)} hostable${summary.manifest ? ", with manifest" : ""}) to ${environment}`;
 	if (input.dryRun) return {
 		code: 0,
-		output: describe("would push")
+		output: describe("would push", configured === "" ? "the key's environment" : configured)
 	};
 	const auth = await pushAuth(url, input.env, cliRuntime(input.io, input.env));
+	const environment = configured === "" ? await keyEnvironment(input.io, url, auth.bearer) : configured;
 	const response = await httpRequest(input.io, {
 		url: `${url}/v1/environments/${encodeURIComponent(environment)}/catalog`,
 		method: "POST",
@@ -109,7 +155,7 @@ async function runCloud(input) {
 	};
 	return {
 		code: 0,
-		output: describe("pushed")
+		output: describe("pushed", environment)
 	};
 }
 //#endregion

package/dist/{pushed-policy-DCW91KQU.d.ts → pushed-policy-D1Eoi6NM.d.ts}

@@ -1,11 +1,11 @@
-import { Gt as SnapshotScope, H as WireValidity, T as Policy, _ as GrantLimit, a as ApprovalRequirement, bn as Grantee, jn as AppObligation, u as BreakGlassSpec, ur as Condition, v as GrantMeta } from "./policy-types-n0uRTsW8.js";
-import { t as JsonSchemaNode } from "./json-schema-CN_iLFH2.js";
+import { Fn as AppObligation, H as WireValidity, T as Policy, Yt as SnapshotScope, _ as GrantLimit, a as ApprovalRequirement, mr as Condition, u as BreakGlassSpec, v as GrantMeta, wn as Grantee } from "./policy-types-CCiDRZBH.js";
+import { t as JsonSchemaNode } from "./json-schema-BfXgnRNT.js";
 //#region src/catalog/pushed-policy.d.ts
 /**
  * One code grant as `permdock cloud push` sends it. `portable: false` marks a
  * grant a snapshot cannot evaluate; `closure: true` marks one whose condition
- * is code, which `policyFromCatalog` turns into an allow that never matches
- * and a deny that always applies.
+ * is code, which `policyFromCatalog` turns into an allow that never matches and
+ * a deny that always applies.
  */
 type PushedGrant = {
   readonly permission: string;
@@ -33,7 +33,10 @@ type PushedGrant = {
   readonly obligations?: readonly AppObligation[];
   readonly meta?: GrantMeta;
 };
-/** PushedPolicy v1: the `policy` of a `permdock cloud push` body, validated by `schemas/pushed-policy-v1.json`. */
+/**
+ * PushedPolicy v1: the `policy` of a `permdock cloud push` body, validated by
+ * `schemas/pushed-policy-v1.json`.
+ */
 type PushedPolicy = {
   readonly v: 1;
   /** The code policy's `fingerprint`. */
@@ -44,7 +47,10 @@ type PushedPolicy = {
 };
 /** `schemas/pushed-policy-v1.json`; a test keeps the two equal. */
 declare const PUSHED_POLICY_SCHEMA: JsonSchemaNode;
-/** The code policy as `permdock cloud push` sends it; hosted grants are left out. */
+/**
+ * The code policy as `permdock cloud push` sends it; hosted grants are left
+ * out.
+ */
 declare function pushedPolicy(policy: Policy): PushedPolicy;
 /**
  * Validates a pushed policy (parsed, or the JSON text) against

package/dist/{pushed-policy-CqtxkV4G.js → pushed-policy-ITwYKvvH.js}

@@ -1,10 +1,10 @@
 import { t as compact } from "./compact-CAf557ZB.js";
-import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { n as PermDockValidationError } from "./validation-error-ZfUHbKvf.js";
-import { n as RFC3339_PATTERN } from "./time-DkWjdL98.js";
-import { i as wireValidity } from "./validity-CZ7-y0Cj.js";
-import { n as snapshotScopes } from "./instance-snapshot-BOEhcqIF.js";
-import { n as copyJson, r as forbiddenKeyPath, t as checkSchema } from "./json-schema-B-vAwlde.js";
+import { n as freezeDeep } from "./freeze-jjan0lCv.js";
+import { n as PermDockValidationError } from "./validation-error-CYg2kJEw.js";
+import { n as RFC3339_PATTERN } from "./time-nR1JesoH.js";
+import { i as wireValidity } from "./validity-Buc7w8E9.js";
+import { n as snapshotScopes } from "./instance-snapshot--JWiTrvO.js";
+import { n as copyJson, r as forbiddenKeyPath, t as checkSchema } from "./json-schema-BPGa-RjQ.js";
 //#region src/catalog/pushed-policy.ts
 const strings = {
 	type: "array",
@@ -186,7 +186,10 @@ function pushedGrant(grant) {
 		meta: grant.meta === void 0 || Object.keys(grant.meta).length === 0 ? void 0 : grant.meta
 	});
 }
-/** The code policy as `permdock cloud push` sends it; hosted grants are left out. */
+/**
+* The code policy as `permdock cloud push` sends it; hosted grants are left
+* out.
+*/
 function pushedPolicy(policy) {
 	const scopes = snapshotScopes(policy);
 	return {

package/dist/react/index.d.ts

@@ -1,8 +1,9 @@
-import { n as requiredPlans } from "../problem-details-B45V5d2b.js";
-import { i as describe } from "../describe-B5qgDvEW.js";
-import { t as approvalHeaders } from "../headers-CIbDTUTK.js";
-import { a as FilterResult, c as PermissionSet, f as SubjectView, i as ClientStatus, l as PermissionState, n as ApprovalState, o as GateMode, p as TenantView, r as ClientPermDock, s as GateView, t as ApprovalHandle } from "../types-B3_ooZgZ.js";
-import { n as PermDockProviderProps, r as ProtectedProps, t as PermDockDefaults } from "../types-CX7AvRqP.js";
-import { a as useDescribe, c as useMemberships, d as usePermissions, f as useRoles, i as useAssignableRoles, l as usePermDock, m as useTenant, n as useApproval, o as useFilter, p as useSubject, r as useAssignablePermissions, s as useGate, t as Protected, u as usePermission } from "../protected-RFGpakN9.js";
-import { t as PermDockProvider } from "../provider-DILL9oPK.js";
-export { type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type FilterResult, type GateMode, type GateView, type PermDockDefaults, PermDockProvider, type PermDockProviderProps, type PermissionSet, type PermissionState, Protected, type ProtectedProps, type SubjectView, type TenantView, approvalHeaders, describe, requiredPlans, useApproval, useAssignablePermissions, useAssignableRoles, useDescribe, useFilter, useGate, useMemberships, usePermDock, usePermission, usePermissions, useRoles, useSubject, useTenant };
+import { c as requiredPlans } from "../errors-zi_4T-rx.js";
+import { i as describe } from "../describe-ByS9LgHK.js";
+import { n as ProtectedAction, t as ActionResult } from "../action-result-CL-QCITA.js";
+import { t as approvalHeaders } from "../headers-B9jQxjtW.js";
+import { a as FilterResult, b as eventSourceRefresh, c as PermissionSet, d as ProtectedActionView, h as TenantView, i as ClientStatus, l as PermissionState, m as SubjectView, n as ApprovalState, o as GateMode, p as RolesOptions, r as ClientPermDock, s as GateView, t as ApprovalHandle, u as ProtectedActionHandle, v as EventSourceRefreshOptions, y as RefreshTrigger } from "../types-B_d_g7T3.js";
+import { n as PermDockProviderProps, r as ProtectedProps, t as PermDockDefaults } from "../types-BJk0BKRX.js";
+import { a as useAssignableRoles, c as useGate, d as usePermission, f as usePermissions, h as useTenant, i as useAssignablePermissions, l as useMemberships, m as useSubject, n as Protected, o as useDescribe, p as useRoles, r as useApproval, s as useFilter, t as useProtectedAction, u as usePermDock } from "../protected-action-BE7N_Luo.js";
+import { t as PermDockProvider } from "../provider-DXfq5c2d.js";
+export { type ActionResult, type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type EventSourceRefreshOptions, type FilterResult, type GateMode, type GateView, type PermDockDefaults, PermDockProvider, type PermDockProviderProps, type PermissionSet, type PermissionState, Protected, type ProtectedAction, type ProtectedActionHandle, type ProtectedActionView, type ProtectedProps, type RefreshTrigger, type RolesOptions, type SubjectView, type TenantView, approvalHeaders, describe, eventSourceRefresh, requiredPlans, useApproval, useAssignablePermissions, useAssignableRoles, useDescribe, useFilter, useGate, useMemberships, usePermDock, usePermission, usePermissions, useProtectedAction, useRoles, useSubject, useTenant };

package/dist/react/index.js

@@ -1,7 +1,8 @@
 "use client";
-import { r as requiredPlans } from "../problem-details-cn5X30gZ.js";
-import { t as describe } from "../describe-BybMRY7A.js";
-import { t as approvalHeaders } from "../headers-BIjfMaoC.js";
-import { a as useDescribe, c as useMemberships, d as usePermissions, f as useRoles, i as useAssignableRoles, l as usePermDock, m as useTenant, n as useApproval, o as useFilter, p as useSubject, r as useAssignablePermissions, s as useGate, t as Protected, u as usePermission } from "../protected-BlF0F6wL.js";
-import { t as PermDockProvider } from "../provider-B1al-AZz.js";
-export { PermDockProvider, Protected, approvalHeaders, describe, requiredPlans, useApproval, useAssignablePermissions, useAssignableRoles, useDescribe, useFilter, useGate, useMemberships, usePermDock, usePermission, usePermissions, useRoles, useSubject, useTenant };
+import { r as requiredPlans } from "../problem-details-CLDgX1KV.js";
+import { n as describe } from "../describe-Bb4hGK5d.js";
+import { r as approvalHeaders } from "../protected-action-DUYqb-Ma.js";
+import { r as eventSourceRefresh } from "../store-options-Dil3lraY.js";
+import { a as useAssignableRoles, c as useGate, d as usePermission, f as usePermissions, h as useTenant, i as useAssignablePermissions, l as useMemberships, m as useSubject, n as Protected, o as useDescribe, p as useRoles, r as useApproval, s as useFilter, t as useProtectedAction, u as usePermDock } from "../protected-action-QEA8arRB.js";
+import { t as PermDockProvider } from "../provider-C55OGXJ7.js";
+export { PermDockProvider, Protected, approvalHeaders, describe, eventSourceRefresh, requiredPlans, useApproval, useAssignablePermissions, useAssignableRoles, useDescribe, useFilter, useGate, useMemberships, usePermDock, usePermission, usePermissions, useProtectedAction, useRoles, useSubject, useTenant };

package/dist/react/provider-client.d.ts

@@ -1,2 +1,2 @@
-import { t as PermDockProvider } from "../provider-DILL9oPK.js";
+import { t as PermDockProvider } from "../provider-DXfq5c2d.js";
 export { PermDockProvider };

package/dist/react/provider-client.js

@@ -1,2 +1,2 @@
 "use client";
-export { t as PermDockProvider } from "../provider-B1al-AZz.js";
+export { t as PermDockProvider } from "../provider-C55OGXJ7.js";