permdock 0.6.0 → 0.8.0

package/dist/react-native/index.js

@@ -1,24 +1,28 @@
 "use client";
-import { t as compact } from "../compact-CAf557ZB.js";
-import { n as freezeDeep } from "../freeze-CrU8nQeX.js";
-import { r as requiredPlans } from "../problem-details-cn5X30gZ.js";
-import { t as describe } from "../describe-BybMRY7A.js";
-import { n as isThenable } from "../thenable-yD7SabqG.js";
-import { h as secondsAt, m as rfc3339 } from "../time-DkWjdL98.js";
-import { a as normalizeMemberships, d as scopeList, m as tenantOf$1, o as resolveScope } from "../scopes-CUPSjo9q.js";
-import { o as flattenGrantee } from "../grantee-hxrUsbpM.js";
-import { d as resolveActiveTenant } from "../tenancy-DN2QAx9z.js";
-import { i as bindConditionRefs, n as parseSnapshot } from "../snapshot-B7DkYg6g.js";
-import { r as heldRoleNames, t as emptySnapshot } from "../from-snapshot-CTCMsFZk.js";
-import { t as parseLocalSnapshotManifest } from "../parse-local-manifest-CVSs6J9I.js";
-import { t as approvalHeaders } from "../headers-BIjfMaoC.js";
-import { n as storeOf, r as isJws, t as adapterStore } from "../store-options-u0ycEe8s.js";
-import { a as PermDockUiContext, i as PermDockStoreContext, n as useKeyed, t as useLiveOptions } from "../live-options-BaAFCIiu.js";
-import { a as useDescribe, c as useMemberships, d as usePermissions, f as useRoles, i as useAssignableRoles, l as usePermDock, m as useTenant, n as useApproval, o as useFilter, p as useSubject, r as useAssignablePermissions, s as useGate, t as Protected, u as usePermission } from "../protected-BlF0F6wL.js";
+import { r as isRecord, t as compact } from "../compact-CAf557ZB.js";
+import { n as freezeDeep } from "../freeze-jjan0lCv.js";
+import { r as requiredPlans } from "../problem-details-CLDgX1KV.js";
+import { n as describe } from "../describe-Bb4hGK5d.js";
+import { n as isThenable } from "../thenable-BNSM1U2R.js";
+import { h as secondsAt, m as rfc3339 } from "../time-nR1JesoH.js";
+import { f as scopeList, h as tenantOf$1, o as normalizeMemberships, s as resolveScope } from "../scopes-0Up_UA2t.js";
+import { o as flattenGrantee } from "../grantee-Dke-9rd1.js";
+import { t as byCodePoint } from "../compare-DTfyUunF.js";
+import { d as resolveActiveTenant, r as isMembershipExpired } from "../tenancy-5d1zVBvK.js";
+import { a as bindConditionRefs, n as parseSnapshot } from "../snapshot-CXlzi69u.js";
+import { r as heldRoleNames, t as emptySnapshot } from "../from-snapshot-DCakWRsr.js";
+import { t as parseLocalSnapshotManifest } from "../parse-local-manifest-DEiCF4ah.js";
+import { r as approvalHeaders } from "../protected-action-DUYqb-Ma.js";
+import { i as isJws, n as storeOf, r as eventSourceRefresh, t as adapterStore } from "../store-options-Dil3lraY.js";
+import { a as PermDockUiContext, i as PermDockStoreContext, n as useKeyed, t as useLiveOptions } from "../live-options-BBIT68le.js";
+import { a as useAssignableRoles, c as useGate, d as usePermission, f as usePermissions, h as useTenant, i as useAssignablePermissions, l as useMemberships, m as useSubject, n as Protected, o as useDescribe, p as useRoles, r as useApproval, s as useFilter, t as useProtectedAction, u as usePermDock } from "../protected-action-QEA8arRB.js";
 import { useEffect, useMemo, useRef } from "react";
 import { jsx } from "react/jsx-runtime";
 //#region src/react-native/guards.ts
-/** `true` once the provider has a snapshot to answer from: storage was read or a seed was given. Hide the splash screen on it. */
+/**
+* `true` once the provider has a snapshot to answer from: storage was read or a
+* seed was given. Hide the splash screen on it.
+*/
 function useSnapshotReady() {
 	return usePermDock().status() !== "pending";
 }
@@ -41,6 +45,71 @@ function usePermissionGuard(permission, data) {
 	]);
 }
 //#endregion
+//#region src/react-native/local-assignable.ts
+/**
+* The levels a holder of `level` on `key` may hand out; `undefined` when the
+* table does not know the entry.
+*/
+function entryReach(table, key, level) {
+	const row = Object.hasOwn(table.permissions, key) ? table.permissions[key] : void 0;
+	if (row === void 0) return;
+	if (level === void 0) return row.reach;
+	return row.levelReach !== void 0 && Object.hasOwn(row.levelReach, level) ? row.levelReach[level] : void 0;
+}
+/** The levels a holder of `role`'s included grants on `key` may hand out. */
+function includeReach(table, role, key) {
+	const byKey = table.includeReach !== void 0 && Object.hasOwn(table.includeReach, role) ? table.includeReach[role] : void 0;
+	return byKey !== void 0 && Object.hasOwn(byKey, key) ? byKey[key] : void 0;
+}
+function listOf(record, key) {
+	return record !== void 0 && Object.hasOwn(record, key) ? record[key] ?? [] : [];
+}
+/**
+* What the subject may hand out in `tenant`, by the rules of `assignableIn`:
+* declared assignable roles and the tenant's custom roles, intersected with the
+* permissions and levels the subject holds there. Holding a `meta.manageRoles`
+* role, or an unconditioned allow of a `meta.manageRoles` permission, lifts the
+* intersection.
+*/
+function localAssignableFor(input) {
+	const { rules, custom, tenant, heldNames } = input;
+	const allows = input.held.filter((item) => item.grant.effect === "allow");
+	const heldKeys = new Set(allows.map((item) => item.grant.permission));
+	const unconditioned = (effect, key) => input.held.some(({ grant }) => grant.effect === effect && grant.permission === key && grant.where === void 0 && grant.check === void 0 && grant.approval === void 0 && grant.validity === void 0);
+	const manage = heldNames.some((name) => rules.manage.roles.includes(name)) || rules.manage.permissions.some((key) => unconditioned("allow", key) && !unconditioned("deny", key));
+	const held = new Set(heldNames);
+	const listed = rules.assigns === void 0 ? void 0 : new Set(heldNames.flatMap((name) => listOf(rules.assigns, name)));
+	const roles = rules.roles.filter((item) => {
+		if (manage) return true;
+		if (listed !== void 0) return listed.has(item.name);
+		return held.has(item.name) || item.allows.length > 0 && item.allows.every((key) => heldKeys.has(key));
+	});
+	const permissions = rules.permissions.filter((leaf) => manage || heldKeys.has(leaf.key));
+	const offered = (key) => {
+		const names = listOf(rules.levels, key);
+		if (manage) return names;
+		const reached = new Set(allows.filter((item) => item.grant.permission === key).flatMap((item) => item.reach ?? []));
+		return names.filter((name) => reached.has(name));
+	};
+	const levels = {};
+	for (const leaf of permissions) if (listOf(rules.levels, leaf.key).length > 0) levels[leaf.key] = offered(leaf.key);
+	const assignsAt = manage ? void 0 : new Set(roles.map((item) => item.on));
+	const mayHandOut = (scope, allow) => {
+		const table = Object.hasOwn(custom, scope) ? custom[scope] : void 0;
+		if (table === void 0 || !Object.hasOwn(table.permissions, allow.key) || !(manage || heldKeys.has(allow.key))) return false;
+		if (listOf(rules.levels, allow.key).length === 0) return true;
+		const can = offered(allow.key);
+		return (allow.reach ?? []).every((name) => can.includes(name));
+	};
+	const customNames = input.customRoles.filter((role) => (assignsAt === void 0 || assignsAt.has(role.scope)) && role.allows.length > 0 && role.allows.every((allow) => mayHandOut(role.scope, allow))).toSorted((a, b) => Number(!a.shared) - Number(!b.shared) || byCodePoint(a.name, b.name)).map((role) => role.name);
+	return compact({
+		tenant,
+		roles: [...roles.map((item) => item.name), ...new Set(customNames)],
+		permissions,
+		levels: Object.keys(levels).length === 0 ? void 0 : levels
+	});
+}
+//#endregion
 //#region src/react-native/local.ts
 const CARRIED = /* @__PURE__ */ new Set([
 	"id",
@@ -75,8 +144,8 @@ function renamed(grant, name) {
 	};
 }
 /**
-* The grants a custom role holds, from the entries the server resolved one
-* by one: an entry the table does not know grants nothing.
+* The grants a custom role holds, from the entries the server resolved one by
+* one: an entry the table does not know grants nothing.
 */
 function customGrants(table, role) {
 	const entries = Array.isArray(role.grants) ? role.grants : [];
@@ -102,22 +171,38 @@ function customGrants(table, role) {
 		});
 	}
 	const out = [];
+	const reached = [];
 	const included = /* @__PURE__ */ new Set();
 	const names = Array.isArray(role.includes) ? role.includes : [];
 	for (const name of names) {
 		const list = typeof name === "string" && Object.hasOwn(table.includes, name) ? table.includes[name] : void 0;
 		for (const grant of list ?? []) {
 			if (grant.effect === "deny" || !removed.has(grant.permission)) out.push(grant);
-			if (grant.effect === "allow") included.add(grant.permission);
+			if (grant.effect === "allow") {
+				included.add(grant.permission);
+				if (!removed.has(grant.permission) && typeof name === "string") reached.push({
+					key: grant.permission,
+					reach: includeReach(table, name, grant.permission)
+				});
+			}
 		}
 	}
 	for (const { key, level } of allows) {
 		if (removed.has(key) || included.has(key)) continue;
 		const row = Object.hasOwn(table.permissions, key) ? table.permissions[key] : void 0;
 		const grants = typeof level === "string" ? row?.levels?.[level] : row?.all;
-		out.push(...grants ?? []);
+		if (grants !== void 0 && grants.length > 0) {
+			out.push(...grants);
+			reached.push({
+				key,
+				reach: entryReach(table, key, typeof level === "string" ? level : void 0)
+			});
+		}
 	}
-	return out.map((grant) => renamed(grant, role.name));
+	return {
+		grants: out.map((grant) => renamed(grant, role.name)),
+		allows: reached
+	};
 }
 function isList(value) {
 	return Array.isArray(value);
@@ -158,39 +243,60 @@ function buildLocalSnapshot(manifest, data, at) {
 	const declared = new Set(manifest.roles);
 	const globalRoles = new Set(input?.roles ?? []);
 	const grants = [];
-	const attach = (grant, membership) => {
-		grants.push(bindGrant(membership === void 0 ? grant : {
+	const held = [];
+	const attach = (grant, membership, reach) => {
+		const bound = bindGrant(membership === void 0 ? grant : {
 			...grant,
 			membership
-		}, subject));
+		}, subject);
+		grants.push(bound);
+		if (membership === void 0 || tenantOf$1(membership, scopes) === tenant && !isMembershipExpired(membership, now)) held.push({
+			grant: bound,
+			reach
+		});
 	};
-	for (const grant of manifest.grants) {
+	const grantReach = manifest.assignable?.grants;
+	for (const [index, grant] of manifest.grants.entries()) {
+		const reach = grantReach !== void 0 && Object.hasOwn(grantReach, String(index)) ? grantReach[String(index)] : void 0;
 		const roleItems = flattenGrantee(grant.to).filter((item) => item.kind === "role");
 		if (roleItems.length > 0 && principal === null) continue;
 		if (!roleItems.every((item) => item.scope !== "global" || declared.has(item.role) && globalRoles.has(item.role))) continue;
 		const scoped = roleItems.filter((item) => item.scope !== "global");
 		if (scoped.length === 0) {
-			attach(grant);
+			attach(grant, void 0, reach);
 			continue;
 		}
-		for (const membership of memberships) if (scoped.every((item) => declared.has(item.role) && membership.roles.includes(item.role) && (typeof item.scope === "string" ? membership.scope === item.scope : membership.on !== void 0))) attach(grant, membership);
+		for (const membership of memberships) if (scoped.every((item) => declared.has(item.role) && membership.roles.includes(item.role) && (typeof item.scope === "string" ? membership.scope === item.scope : membership.on !== void 0))) attach(grant, membership, reach);
 	}
 	const formed = (data.customRoles ?? []).filter((role) => role !== null && typeof role === "object" && typeof role.name === "string" && !declared.has(role.name));
 	const sharedNames = new Set(formed.filter((role) => role.shared === true).map((role) => role.name));
 	const custom = formed.filter((role) => role.shared === true || role.scope === "global" || !sharedNames.has(role.name));
+	const tenantCustom = [];
+	const tenantRoles = /* @__PURE__ */ new Set();
 	for (const role of custom) {
 		const scope = customScope(role, scopes);
 		const table = scope !== void 0 && Object.hasOwn(manifest.custom, scope) ? manifest.custom[scope] : void 0;
 		if (scope === void 0 || table === void 0) continue;
-		const resolved = customGrants(table, role);
+		const { grants: resolved, allows } = customGrants(table, role);
+		const reachOf = (permission) => [...new Set(allows.filter((allow) => allow.key === permission).flatMap((allow) => allow.reach ?? []))];
 		if (scope === "global") {
-			if (role.tenant === void 0 && globalRoles.has(role.name)) for (const grant of resolved) attach(grant);
+			if (role.tenant === void 0 && globalRoles.has(role.name)) for (const grant of resolved) attach(grant, void 0, reachOf(grant.permission));
 			continue;
 		}
+		if (tenant !== void 0 && (role.shared === true ? role.tenant === void 0 : role.tenant === tenant) && !tenantRoles.has(role.name)) {
+			tenantRoles.add(role.name);
+			tenantCustom.push({
+				name: role.name,
+				scope,
+				shared: role.shared === true,
+				allows
+			});
+		}
 		const id = role.team ?? role.id;
-		for (const membership of memberships) if (membership.scope === scope && (role.shared === true ? role.tenant === void 0 && id === void 0 && tenantOf$1(membership, scopes) !== void 0 : typeof role.tenant === "string" && tenantOf$1(membership, scopes) === role.tenant) && (id === void 0 || membership.id === id) && membership.roles.includes(role.name)) for (const grant of resolved) attach(grant, membership);
+		for (const membership of memberships) if (membership.scope === scope && (role.shared === true ? role.tenant === void 0 && id === void 0 && tenantOf$1(membership, scopes) !== void 0 : typeof role.tenant === "string" && tenantOf$1(membership, scopes) === role.tenant) && (id === void 0 || membership.id === id) && membership.roles.includes(role.name)) for (const grant of resolved) attach(grant, membership, reachOf(grant.permission));
 	}
 	const roles = subject.principal === null ? [] : heldRoleNames(subject, tenant, scopes, { rank: manifest.rank ?? [] }, now);
+	const rules = manifest.assignable;
 	return freezeDeep(compact({
 		v: 1,
 		issuedAt: rfc3339(now),
@@ -201,13 +307,21 @@ function buildLocalSnapshot(manifest, data, at) {
 		roles,
 		grants,
 		tenants: tenant === void 0 ? [] : [tenant],
+		assignable: tenant === void 0 || rules === void 0 ? void 0 : [localAssignableFor({
+			rules,
+			custom: manifest.custom,
+			tenant,
+			heldNames: roles,
+			held,
+			customRoles: tenantCustom
+		})],
 		scopes: manifest.scopes,
 		vocabulary: manifest.vocabulary
 	}));
 }
 /**
-* A snapshot source over the device's own membership rows (SQLite, a
-* PowerSync or Electric replica): offline, the UI guards answer from them.
+* A snapshot source over the device's own membership rows (SQLite, a PowerSync
+* or Electric replica): offline, the UI guards answer from them.
 */
 function localSnapshot(options) {
 	return compact({
@@ -216,33 +330,232 @@ function localSnapshot(options) {
 	});
 }
 //#endregion
+//#region src/react-native/powersync-rows.ts
+function isColumns(roles) {
+	return Array.isArray(roles);
+}
+function quoted(name) {
+	return `"${name.replaceAll("\"", "\"\"")}"`;
+}
+/**
+* The synced tables `rows` names, each read whole: the subject streams sync
+* only the user's own rows.
+*/
+function rowTables(rows) {
+	const tables = /* @__PURE__ */ new Set();
+	const column = (item) => {
+		if ("through" in item) tables.add(item.through.table);
+	};
+	for (const source of rows.memberships) {
+		tables.add(source.table);
+		column(source.user);
+		if (isColumns(source.roles)) for (const item of source.roles) column(item);
+	}
+	if (rows.roles !== void 0) {
+		tables.add(rows.roles.table);
+		for (const item of rows.roles.roles) column(item);
+	}
+	if (rows.customRoles !== void 0) {
+		tables.add(rows.customRoles.permissions);
+		tables.add(rows.customRoles.includes);
+	}
+	return [...tables];
+}
+function rowQuery(table) {
+	return `SELECT * FROM ${quoted(table)}`;
+}
+function text(value) {
+	if (typeof value === "string") return value === "" ? void 0 : value;
+	return typeof value === "number" || typeof value === "bigint" ? String(value) : void 0;
+}
+function isSet(row, column) {
+	const value = column === void 0 ? void 0 : row[column];
+	return value !== void 0 && value !== null;
+}
+function rowsOf(tables, table) {
+	return (tables[table] ?? []).filter(isRecord);
+}
+/**
+* The value a column holds, read through its referenced table or map;
+* `undefined` for none.
+*/
+function columnValue(row, column, tables) {
+	const raw = text(row[column.column]);
+	if (raw === void 0) return;
+	if ("through" in column) {
+		const { through } = column;
+		const target = rowsOf(tables, through.table).find((item) => text(item[through.id]) === raw);
+		return target === void 0 ? void 0 : text(target[through.column]);
+	}
+	if ("map" in column) return Object.hasOwn(column.map, raw) ? column.map[raw] ?? void 0 : void 0;
+	return raw;
+}
+function membershipsOf(source, tables, user) {
+	const byInstance = /* @__PURE__ */ new Map();
+	for (const row of rowsOf(tables, source.table)) {
+		if (columnValue(row, source.user, tables) !== user || isSet(row, source.expiresAt) || isSet(row, source.disabledAt)) continue;
+		const scope = "value" in source.scope ? source.scope.value : text(row[source.scope.column]);
+		const id = text(row[source.id]);
+		const via = source.via === void 0 ? void 0 : "value" in source.via ? source.via.value : text(row[source.via.column]);
+		const roles = isColumns(source.roles) ? source.roles.flatMap((column) => {
+			const key = columnValue(row, column, tables);
+			return key === void 0 ? [] : [key];
+		}) : source.roles.value;
+		if (scope === void 0 || id === void 0 || roles.length === 0) continue;
+		const key = JSON.stringify([
+			scope,
+			id,
+			via ?? null
+		]);
+		const entry = byInstance.get(key) ?? {
+			scope,
+			id,
+			via,
+			roles: /* @__PURE__ */ new Set()
+		};
+		for (const role of roles) entry.roles.add(role);
+		byInstance.set(key, entry);
+	}
+	return [...byInstance.values()].map((entry) => compact({
+		scope: entry.scope,
+		id: entry.id,
+		roles: [...entry.roles].toSorted(),
+		via: entry.via
+	}));
+}
+function roleKeyOf(row) {
+	const name = text(row["role"]);
+	const scope = text(row["scope"]);
+	return name === void 0 || scope === void 0 ? void 0 : {
+		tenant: text(row["tenant_id"]),
+		scope,
+		id: text(row["scope_id"]),
+		name
+	};
+}
+function customRoleOf({ key, grants, includes }) {
+	const body = {
+		name: key.name,
+		grants,
+		includes
+	};
+	if (key.scope === "global") return {
+		...body,
+		scope: "global"
+	};
+	if (key.tenant === void 0) return {
+		...body,
+		shared: true,
+		scope: key.scope
+	};
+	return compact({
+		...body,
+		tenant: key.tenant,
+		scope: key.scope,
+		id: key.id
+	});
+}
+/**
+* Custom roles from the custom-role rows: a tenant role, a shared role (no
+* tenant) or a global role.
+*/
+function customRolesOf(permissions, includes) {
+	const roles = /* @__PURE__ */ new Map();
+	const entry = (key) => {
+		const id = JSON.stringify([
+			key.tenant ?? null,
+			key.scope,
+			key.id ?? null,
+			key.name
+		]);
+		const found = roles.get(id) ?? {
+			key,
+			grants: [],
+			includes: []
+		};
+		roles.set(id, found);
+		return found;
+	};
+	for (const row of permissions) {
+		const key = roleKeyOf(row);
+		const permission = text(row["permission"]);
+		const effect = row["effect"] === "deny" ? "deny" : "allow";
+		const level = text(row["level"]);
+		if (key !== void 0 && permission !== void 0) entry(key).grants.push(compact({
+			permission,
+			effect,
+			level
+		}));
+	}
+	for (const row of includes) {
+		const key = roleKeyOf(row);
+		const include = text(row["include_role"]);
+		if (key !== void 0 && include !== void 0) entry(key).includes.push(include);
+	}
+	return [...roles.values()].map(customRoleOf);
+}
+/**
+* The user's memberships, global roles and custom roles from the rows of the
+* tables `rows` names.
+*/
+function readRows(rows, tables, principal) {
+	const { id: user, tenant, attributes } = principal;
+	const memberships = rows.memberships.flatMap((source) => membershipsOf(source, tables, user));
+	const global = rows.roles;
+	const roles = global === void 0 ? [] : rowsOf(tables, global.table).flatMap((row) => text(row[global.user]) === user ? global.roles.flatMap((column) => {
+		const key = columnValue(row, column, tables);
+		return key === void 0 ? [] : [key];
+	}) : []);
+	const custom = rows.customRoles;
+	return {
+		principal: {
+			id: user,
+			roles: [...new Set(roles)].toSorted(),
+			memberships,
+			...tenant === void 0 ? {} : { tenant },
+			...attributes === void 0 ? {} : { attributes }
+		},
+		...custom === void 0 ? {} : { customRoles: customRolesOf(rowsOf(tables, custom.permissions), rowsOf(tables, custom.includes)) }
+	};
+}
+//#endregion
 //#region src/react-native/powersync.ts
+function planOf(options) {
+	if (!("user" in options)) return options;
+	const { rows } = options.manifest;
+	if (rows === void 0) throw new TypeError("PermDock: powerSyncSource needs queries and read, or a manifest with rows (run permdock powersync generate with powersync.manifest)");
+	const principal = compact({
+		id: options.user,
+		tenant: options.tenant,
+		attributes: options.attributes
+	});
+	return {
+		queries: Object.fromEntries(rowTables(rows).map((table) => [table, { sql: rowQuery(table) }])),
+		read: (tables) => readRows(rows, tables, principal)
+	};
+}
 /**
 * A `localSnapshot` source over a PowerSync database: `get` runs every query
-* with `db.getAll`, and a `db.watch` per query reports changes. A watch
-* result with unchanged content re-renders nothing (`connectSource`). The source
-* takes the database as an argument; `permdock/react-native` never imports
-* `@powersync/*`.
+* with `db.getAll`, and a `db.watch` per query reports changes. Without
+* `queries` and `read`, it reads the tables `manifest.rows` names: the
+* memberships of every source with null roles dropped, the global roles and the
+* custom roles with their levels. A watch result with unchanged content
+* re-renders nothing (`connectSource`). The source takes the database as an
+* argument; `permdock/react-native` never imports `@powersync/*`.
 */
 function powerSyncSource(db, options) {
-	const names = Object.keys(options.queries);
+	const plan = planOf(options);
 	return localSnapshot({
 		manifest: options.manifest,
 		read: async () => {
-			const results = await Promise.all(names.map(async (name) => {
-				const query = options.queries[name];
+			const results = await Promise.all(Object.entries(plan.queries).map(async ([name, query]) => {
 				return [name, await db.getAll(query.sql, [...query.parameters ?? []])];
 			}));
-			const rows = {};
-			for (const [name, list] of results) rows[name] = list;
-			return options.read(rows);
+			return plan.read(Object.fromEntries(results));
 		},
 		subscribe: (listener) => {
 			const controller = new AbortController();
-			for (const name of names) {
-				const query = options.queries[name];
-				db.watch(query.sql, [...query.parameters ?? []], { onResult: listener }, { signal: controller.signal });
-			}
+			for (const query of Object.values(plan.queries)) db.watch(query.sql, [...query.parameters ?? []], { onResult: listener }, { signal: controller.signal });
 			return () => {
 				controller.abort();
 			};
@@ -337,7 +650,10 @@ function guardStorage(storage) {
 		fail
 	};
 }
-/** `undefined` when the storage answers asynchronously; any failure reads as empty. */
+/**
+* `undefined` when the storage answers asynchronously; any failure reads as
+* empty.
+*/
 function readStoredSync(storage, subjectId, signed) {
 	if (subjectId === null) return NOTHING;
 	const raw = storage.read(SNAPSHOT_KEY);
@@ -374,8 +690,8 @@ function contentKey(snapshot) {
 	});
 }
 /**
-* Whether a source read changes nothing: same content as the snapshot the
-* store holds, and the store already settled on it.
+* Whether a source read changes nothing: same content as the snapshot the store
+* holds, and the store already settled on it.
 */
 function unchanged(store, next) {
 	if (typeof next === "string" || store.get().status() === "stale") return false;
@@ -387,9 +703,9 @@ function unchanged(store, next) {
 }
 /**
 * Hydrates `store` from `source` now, on every change it reports and on each
-* return to the foreground. Only the latest read applies; a read with
-* unchanged content re-renders nothing, and a failed read keeps the current
-* snapshot. Returns the unsubscribe.
+* return to the foreground. Only the latest read applies; a read with unchanged
+* content re-renders nothing, and a failed read keeps the current snapshot.
+* Returns the unsubscribe.
 */
 function connectSource(store, source, subscribeForeground) {
 	let active = true;
@@ -397,8 +713,8 @@ function connectSource(store, source, subscribeForeground) {
 	const pull = () => {
 		seq += 1;
 		const mine = seq;
-		Promise.resolve().then(() => source.get()).then((next) => {
-			if (active && mine === seq && !unchanged(store, next)) store.replace(next);
+		Promise.resolve().then(() => source.get()).then((snapshot) => {
+			if (active && mine === seq && !unchanged(store, snapshot)) store.replace(snapshot);
 		}, () => void 0);
 	};
 	pull();
@@ -454,7 +770,8 @@ function nativeStore(options) {
 		passCache: true,
 		onSnapshot: options.onSnapshot,
 		onClear: options.onClear,
-		approvalInterval: options.approvalInterval
+		approvalInterval: options.approvalInterval,
+		refreshOn: options.refreshOn
 	}), snapshot, {
 		server: false,
 		stale: revalidates && (fromStorage !== void 0 || waiting),
@@ -508,6 +825,7 @@ function PermDockProvider(props) {
 		onSnapshot: live.onSnapshot,
 		onClear: live.onClear,
 		approvalInterval: props.approvalInterval,
+		refreshOn: props.refreshOn,
 		previous: shown.current ?? void 0
 	})), [
 		props.storage,
@@ -549,9 +867,9 @@ function PermDockProvider(props) {
 		const refresh = () => {
 			if (inFlight || !online) return;
 			inFlight = true;
-			store.get().refresh().catch(() => void 0).finally(() => {
+			store.get().refresh().finally(() => {
 				inFlight = false;
-			});
+			}).catch(() => void 0);
 		};
 		const startTimer = () => {
 			if (typeof mode === "number" && timer === void 0) timer = setInterval(refresh, mode * 1e3);
@@ -605,7 +923,10 @@ function PermDockProvider(props) {
 }
 //#endregion
 //#region src/react-native/storage-adapters.ts
-/** SecureStore warns above 2048 bytes and may refuse larger values on some devices. */
+/**
+* SecureStore warns above 2048 bytes and may refuse larger values on some
+* devices.
+*/
 const SECURE_STORE_CHUNK_BYTES = 2048;
 const INDEX_PREFIX = "permdock-chunks:";
 function utf8Length(char) {
@@ -640,9 +961,9 @@ function chunkKey(key, index) {
 	return `${key}.${index}`;
 }
 /**
-* A `SnapshotStorage` over `expo-secure-store`. Values are split into chunks
-* of at most 2048 bytes under `<key>.<n>`; `<key>` holds the chunk count and
-* is written last, so an interrupted write reads as absent.
+* A `SnapshotStorage` over `expo-secure-store`. Values are split into chunks of
+* at most 2048 bytes under `<key>.<n>`; `<key>` holds the chunk count and is
+* written last, so an interrupted write reads as absent.
 */
 function secureStoreStorage(store, options) {
 	const removeChunks = async (key, from, to) => {
@@ -675,7 +996,10 @@ function secureStoreStorage(store, options) {
 		}
 	};
 }
-/** A synchronous `SnapshotStorage` over a `react-native-mmkv` instance: the first frame already has the snapshot. */
+/**
+* A synchronous `SnapshotStorage` over a `react-native-mmkv` instance: the
+* first frame already has the snapshot.
+*/
 function mmkvStorage(mmkv) {
 	return {
 		getItem: (key) => mmkv.getString(key) ?? null,
@@ -691,8 +1015,8 @@ function mmkvStorage(mmkv) {
 //#endregion
 //#region src/react-native/subscriptions.ts
 /**
-* `subscribeForeground` over `AppState`: `active` returns to the foreground
-* and `background` leaves it. iOS `inactive` (a system sheet over the app) is
+* `subscribeForeground` over `AppState`: `active` returns to the foreground and
+* `background` leaves it. iOS `inactive` (a system sheet over the app) is
 * neither.
 */
 function appStateForeground(appState) {
@@ -706,11 +1030,14 @@ function appStateForeground(appState) {
 		};
 	};
 }
-/** `subscribeOnline` over NetInfo. An unknown (`null`) connection counts as online. */
+/**
+* `subscribeOnline` over NetInfo. An unknown (`null`) connection counts as
+* online.
+*/
 function netInfoOnline(netInfo) {
 	return (listener) => netInfo.addEventListener((state) => {
 		listener(state.isConnected !== false && state.isInternetReachable !== false);
 	});
 }
 //#endregion
-export { PermDockProvider, Protected, appStateForeground, approvalHeaders, buildLocalSnapshot, connectSource, describe, localSnapshot, memorySnapshotStorage, mmkvStorage, nativeStore, netInfoOnline, parseLocalSnapshotManifest, powerSyncSource, requiredPlans, secureStoreStorage, useApproval, useAssignablePermissions, useAssignableRoles, useDescribe, useFilter, useGate, useMemberships, usePermDock, usePermission, usePermissionGuard, usePermissions, useRoles, useSnapshotReady, useSubject, useTenant };
+export { PermDockProvider, Protected, appStateForeground, approvalHeaders, buildLocalSnapshot, connectSource, describe, eventSourceRefresh, localSnapshot, memorySnapshotStorage, mmkvStorage, nativeStore, netInfoOnline, parseLocalSnapshotManifest, powerSyncSource, requiredPlans, secureStoreStorage, useApproval, useAssignablePermissions, useAssignableRoles, useDescribe, useFilter, useGate, useMemberships, usePermDock, usePermission, usePermissionGuard, usePermissions, useProtectedAction, useRoles, useSnapshotReady, useSubject, useTenant };