permdock 0.6.0 → 0.8.0

package/dist/{standard-webhooks-rbD7LS6h.d.ts → standard-webhooks-C-qX4mJW.d.ts}

@@ -1,5 +1,5 @@
-import { Rt as Instant, tr as JsonWebKeyLike } from "./policy-types-n0uRTsW8.js";
-import { l as ReplayStore } from "./types-C791HFu9.js";
+import { Rt as Instant, ar as JsonWebKeyLike } from "./policy-types-CCiDRZBH.js";
+import { l as ReplayStore } from "./types-DjuMBNF9.js";
 //#region src/server/standard-webhooks.d.ts
 /** The three Standard Webhooks headers a delivery carries. */
 type WebhookHeaders = {
@@ -34,7 +34,7 @@ type WebhookMessage = {
   readonly now?: Instant;
 };
 type WebhookSigner = {
-  sign(message: WebhookMessage): Promise<WebhookHeaders>;
+  sign: (message: WebhookMessage) => Promise<WebhookHeaders>;
 };
 /** An Ed25519 public JWK set for `v1a`, or the URL that serves one. */
 type WebhookJwks = {
@@ -70,12 +70,12 @@ type VerifiedWebhookMessage = {
 };
 type WebhookVerifier = {
   /** Never throws; claims the `webhook-id` only after a signature verifies. */
-  verify(input: WebhookInput): Promise<VerifiedWebhookMessage>;
+  verify: (input: WebhookInput) => Promise<VerifiedWebhookMessage>;
 };
 /**
- * Signs Standard Webhooks deliveries: `v1` HMAC-SHA256 with a `whsec_`
- * secret, `v1a` Ed25519 with a private JWK. Throws on an invalid key or id,
- * because both come from the sender's own configuration.
+ * Signs Standard Webhooks deliveries: `v1` HMAC-SHA256 with a `whsec_` secret,
+ * `v1a` Ed25519 with a private JWK. Throws on an invalid key or id, because
+ * both come from the sender's own configuration.
  */
 declare function webhookSigner(options: WebhookSignerOptions): WebhookSigner;
 /**

package/dist/{standard-webhooks-DgFFD-Ga.js → standard-webhooks-D67a3nzk.js}

@@ -1,5 +1,5 @@
-import { m as rfc3339, p as nowSeconds } from "./time-DkWjdL98.js";
-import { n as readBodyText } from "./body-text-QcXok_SI.js";
+import { m as rfc3339, p as nowSeconds } from "./time-nR1JesoH.js";
+import { n as readBodyText } from "./body-text-DQhcmqdY.js";
 //#region src/server/standard-webhooks.ts
 const DEFAULT_TOLERANCE = 300;
 const JWKS_TTL_SECONDS = 300;
@@ -41,9 +41,9 @@ function validId(id) {
 	return id.length > 0 && id.length <= 256 && !/\s/u.test(id);
 }
 /**
-* Signs Standard Webhooks deliveries: `v1` HMAC-SHA256 with a `whsec_`
-* secret, `v1a` Ed25519 with a private JWK. Throws on an invalid key or id,
-* because both come from the sender's own configuration.
+* Signs Standard Webhooks deliveries: `v1` HMAC-SHA256 with a `whsec_` secret,
+* `v1a` Ed25519 with a private JWK. Throws on an invalid key or id, because
+* both come from the sender's own configuration.
 */
 function webhookSigner(options) {
 	if (options.keys.length === 0) throw new TypeError("PermDock: webhookSigner() needs at least one key");

package/dist/{store-BDutJkDL.js → store-RNFvaJJv.js}

@@ -1,10 +1,10 @@
 import { t as compact } from "./compact-CAf557ZB.js";
-import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { i as flattenApprovers } from "./approvers-CqPOLD-o.js";
-import { a as durationOf, i as dateAt } from "./time-DkWjdL98.js";
-import { s as rootMembershipId } from "./scopes-CUPSjo9q.js";
-import { n as matchGrantee } from "./grantee-match-DbENBHLB.js";
-import { a as escalationOpenAt, i as approverRelationKey, o as stageEscalationOpenAt, r as approvalQuorum, s as ApprovalError } from "./types-DqzsnlSA.js";
+import { n as freezeDeep } from "./freeze-jjan0lCv.js";
+import { i as flattenApprovers } from "./approvers-B4r0N_Uz.js";
+import { a as durationOf, i as dateAt } from "./time-nR1JesoH.js";
+import { c as rootMembershipId } from "./scopes-0Up_UA2t.js";
+import { n as matchGrantee } from "./grantee-match-7RZZvoT_.js";
+import { a as escalationOpenAt, i as approverRelationKey, o as stageEscalationOpenAt, r as approvalQuorum, s as ApprovalError } from "./types-CcUXciSj.js";
 //#region src/approvals/page.ts
 const DEFAULT_PAGE_SIZE = 50;
 const MAX_PAGE_SIZE = 200;
@@ -26,7 +26,10 @@ function compare(a, b) {
 function encodeApprovalCursor(request) {
 	return JSON.stringify(positionOf(request));
 }
-/** The `(createdAt, token)` position a `next` cursor names, or `null` for one that does not parse. */
+/**
+* The `(createdAt, token)` position a `next` cursor names, or `null` for one
+* that does not parse.
+*/
 function decodeApprovalCursor(cursor) {
 	try {
 		const parsed = JSON.parse(cursor);
@@ -38,8 +41,8 @@ function decodeApprovalCursor(cursor) {
 /**
 * Pages already-filtered requests in `(createdAt, token)` order, as the
 * built-in stores do: `limit` within 1 to 200 (50 when absent), `cursor` from
-* the previous page's `next`, and no items for a cursor that does not parse.
-* A custom `ApprovalStore` that filters in memory returns it from `list`.
+* the previous page's `next`, and no items for a cursor that does not parse. A
+* custom `ApprovalStore` that filters in memory returns it from `list`.
 */
 function pageApprovals(matching, query) {
 	const after = query.cursor === void 0 ? void 0 : decodeApprovalCursor(query.cursor);
@@ -53,7 +56,10 @@ function pageApprovals(matching, query) {
 		next: encodeApprovalCursor(last)
 	} : { items };
 }
-/** Every matching request of `store`, following `next` until the last page (at most 1000 pages of 200). */
+/**
+* Every matching request of `store`, following `next` until the last page (at
+* most 1000 pages of 200).
+*/
 function listAllApprovals(store, filter) {
 	const collect = async (cursor, pages, items) => {
 		const page = await store.list(cursor === void 0 ? {
@@ -70,10 +76,13 @@ function listAllApprovals(store, filter) {
 	return collect(void 0, 0, []);
 }
 //#endregion
-//#region src/approvals/store.ts
-function tenantOf(request) {
-	return request.subject.principal?.tenant;
-}
+//#region src/approvals/tenancy.ts
+/**
+* The tenants a subject acts in for approvals: `principal.tenant` and the
+* instance of every membership at the first scope. A membership at a nested
+* scope (a team, or one with `within`) names no tenant, even when its parent is
+* the request's tenant.
+*/
 function membershipTenants(subject) {
 	const principal = subject.principal;
 	if (principal === null) return [];
@@ -88,6 +97,11 @@ function membershipTenants(subject) {
 function belongsToTenant(subject, tenant) {
 	return membershipTenants(subject).includes(tenant);
 }
+//#endregion
+//#region src/approvals/store.ts
+function tenantOf(request) {
+	return request.subject.principal?.tenant;
+}
 function holdsRole(subject, role, tenant) {
 	const principal = subject.principal;
 	if (principal === null) return false;
@@ -164,14 +178,14 @@ function vouchedRule(verdict) {
 	return typeof verdict.vouched === "string" && verdict.vouched !== "" ? verdict.vouched : void 0;
 }
 /**
-* Refuses `by` as an approver of `request`, or returns the index of the
-* stage the approval counts for (`undefined` without `stages`). Eligibility
-* is `approvers.by` or, under `stages`, the first incomplete stage
-* (`sequential`) or any incomplete stage (`all`); `approvers.escalation.to`
-* is eligible too once the request has waited `escalation.after`. A
-* principal who already approved is refused, so one person never completes
-* two stages. `relations` are the relation approvers `by` holds on the
-* request's resource (see `ApprovalVerdict.relations`).
+* Refuses `by` as an approver of `request`, or returns the index of the stage
+* the approval counts for (`undefined` without `stages`). Eligibility is
+* `approvers.by` or, under `stages`, the first incomplete stage (`sequential`)
+* or any incomplete stage (`all`); `approvers.escalation.to` is eligible too
+* once the request has waited `escalation.after`. A principal who already
+* approved is refused, so one person never completes two stages. `relations`
+* are the relation approvers `by` holds on the request's resource (see
+* `ApprovalVerdict.relations`).
 */
 function assertApprover(request, by, requireDistinctApprover, at, relations = [], permissions = []) {
 	const now = dateAt(at);
@@ -211,12 +225,12 @@ function isSystemSubject(by) {
 	return by.actor?.kind === "system";
 }
 /**
-* The request after `verdict`, for a store to persist: a rejection resolves
-* it; an approval is appended to `approvals` and resolves it once there are
-* `approvers.quorum` (default 1). Throws an `ApprovalError` when the request
-* is not pending, has expired or `verdict.by` may not approve it. Stores
-* should write the result only when the stored row is still pending with the
-* same number of approvals, so two approvers racing both count.
+* The request after `verdict`, for a store to persist: a rejection resolves it;
+* an approval is appended to `approvals` and resolves it once there are
+* `approvers.quorum` (default 1). Throws an `ApprovalError` when the request is
+* not pending, has expired or `verdict.by` may not approve it. Stores should
+* write the result only when the stored row is still pending with the same
+* number of approvals, so two approvers racing both count.
 */
 function applyApprovalVerdict(request, verdict, at) {
 	const now = dateAt(at);
@@ -355,4 +369,4 @@ function memoryApprovalStore(options = {}) {
 	};
 }
 //#endregion
-export { approvalPageSize as a, listAllApprovals as c, memoryApprovalStore as i, pageApprovals as l, assertApprover as n, decodeApprovalCursor as o, matchesApprovers as r, encodeApprovalCursor as s, applyApprovalVerdict as t };
+export { belongsToTenant as a, decodeApprovalCursor as c, pageApprovals as d, memoryApprovalStore as i, encodeApprovalCursor as l, assertApprover as n, membershipTenants as o, matchesApprovers as r, approvalPageSize as s, applyApprovalVerdict as t, listAllApprovals as u };

package/dist/{store-options-u0ycEe8s.js → store-options-Dil3lraY.js}

@@ -1,11 +1,11 @@
 import { t as compact } from "./compact-CAf557ZB.js";
-import { g as secondsOf } from "./time-DkWjdL98.js";
-import { c as rowIdOf } from "./delegation-j6-rc37o.js";
-import { c as nowSeconds } from "./tenancy-DN2QAx9z.js";
-import { n as payloadDigest } from "./token-BLZcjQgt.js";
-import { n as parseSnapshot } from "./snapshot-B7DkYg6g.js";
-import { s as snapshotClaim } from "./where-scope-C9vfEphl.js";
-import { n as fromSnapshot, t as emptySnapshot } from "./from-snapshot-CTCMsFZk.js";
+import { g as secondsOf } from "./time-nR1JesoH.js";
+import { c as rowIdOf } from "./delegation-CDB6_keF.js";
+import { c as nowSeconds } from "./tenancy-5d1zVBvK.js";
+import { n as payloadDigest } from "./token-DC9EQiet.js";
+import { n as parseSnapshot } from "./snapshot-CXlzi69u.js";
+import { c as snapshotClaim } from "./where-scope-DlCdCM_8.js";
+import { n as fromSnapshot, t as emptySnapshot } from "./from-snapshot-DCakWRsr.js";
 import { t as timeoutSignal } from "./timeout-D51niuQP.js";
 //#region src/client/source.ts
 /** A compact JWS: three non-empty dot-separated parts. */
@@ -131,7 +131,10 @@ const NO_ENDPOINT = {
 	}],
 	alternatives: []
 };
-/** The row's id under the snapshot's id field, or `undefined` for a row without one. */
+/**
+* The row's id under the snapshot's id field, or `undefined` for a row without
+* one.
+*/
 function rowId(snapshot, permission, data) {
 	const id = rowIdOf(data, snapshot.ids?.[permission.resource]);
 	return id === "*" ? void 0 : id;
@@ -140,7 +143,10 @@ function cacheKey(snapshot, permission, data) {
 	if (data === void 0) return `${permission.key}:*`;
 	return `${permission.key}:${rowId(snapshot, permission, data) ?? `#${payloadDigest(data)}`}`;
 }
-/** Collects the checks the snapshot cannot answer and posts them as one AuthZEN batch per microtask. */
+/**
+* Collects the checks the snapshot cannot answer and posts them as one AuthZEN
+* batch per microtask.
+*/
 function createBatch(options) {
 	const { answers, endpoint } = options;
 	let queued = [];
@@ -230,8 +236,75 @@ function createBatch(options) {
 	};
 }
 //#endregion
+//#region src/client/refresh-on.ts
+const DEFAULT_TYPES = ["com.permdock.membership.*", "com.permdock.catalog.*"];
+const REFRESH_DELAY = 250;
+function matches(type, patterns) {
+	return patterns.some((pattern) => pattern.endsWith("*") ? type.startsWith(pattern.slice(0, -1)) : type === pattern);
+}
+function eventType(data) {
+	if (typeof data !== "string") return;
+	try {
+		const parsed = JSON.parse(data);
+		if (typeof parsed === "object" && parsed !== null && "type" in parsed && typeof parsed.type === "string") return parsed.type;
+	} catch {
+		return;
+	}
+}
+/**
+* A `refreshOn` trigger over Server-Sent Events: each `message` whose data is a
+* structured CloudEvent with a matching `type` refreshes the snapshot. Without
+* a global `EventSource` it never fires.
+*/
+function eventSourceRefresh(url, options = {}) {
+	const types = options.types ?? DEFAULT_TYPES;
+	return (refresh) => {
+		if (typeof globalThis.EventSource !== "function") return () => void 0;
+		const source = new globalThis.EventSource(url, { withCredentials: options.withCredentials === true });
+		source.addEventListener("message", (event) => {
+			const type = eventType(event.data);
+			if (type !== void 0 && matches(type, types)) refresh();
+		});
+		return () => {
+			source.close();
+		};
+	};
+}
+/**
+* Runs `triggers` while `start()` holds, folding calls within 250 ms into one
+* `refresh`. `skip()` answering `true` drops a call: after `clear()` or
+* `dispose()` nothing refetches.
+*/
+function refreshTriggers(triggers, refresh, skip) {
+	let offs = [];
+	let timer;
+	const fire = () => {
+		if (skip() || timer !== void 0) return;
+		timer = setTimeout(() => {
+			timer = void 0;
+			if (!skip()) refresh();
+		}, REFRESH_DELAY);
+	};
+	return {
+		start() {
+			if (offs.length === 0) offs = triggers.map((trigger) => trigger(fire));
+		},
+		stop() {
+			for (const off of offs) off();
+			offs = [];
+			if (timer !== void 0) {
+				clearTimeout(timer);
+				timer = void 0;
+			}
+		}
+	};
+}
+//#endregion
 //#region src/client/request.ts
-/** Milliseconds a decision, refresh or approval request may take; a slower one is an error like a failed request. */
+/**
+* Milliseconds a decision, refresh or approval request may take; a slower one
+* is an error like a failed request.
+*/
 const STORE_TIMEOUT_MS = 1e4;
 function storeRequest(fetchImpl, headers) {
 	return (url, body) => fetchImpl(url, {
@@ -313,6 +386,7 @@ function createClientStore(options) {
 	let generation = 0;
 	let disposed = false;
 	let staleNext = options.stale === true;
+	let cleared = false;
 	let rawJws;
 	const request = storeRequest(fetchImpl, () => typeof options.headers === "function" ? options.headers() : options.headers);
 	const emit = () => {
@@ -364,6 +438,7 @@ function createClientStore(options) {
 		reset();
 		if ((snapshot.subject.principal?.id ?? null) !== (next.subject.principal?.id ?? null)) approvals.forget();
 		snapshot = next;
+		cleared = false;
 		instance = fromSnapshot(snapshot, compact({ tenant }));
 		base = "ready";
 		if (staleNext && next.subject.principal !== null) {
@@ -511,12 +586,21 @@ function createClientStore(options) {
 			decision
 		};
 	};
+	const triggers = refreshTriggers(server ? [] : options.refreshOn ?? [], () => {
+		cached.refresh().catch(() => void 0);
+	}, () => disposed || cleared);
 	const subscribe = (listener) => {
 		listeners.add(listener);
-		if (listeners.size === 1) approvals.resume();
+		if (listeners.size === 1) {
+			approvals.resume();
+			triggers.start();
+		}
 		return () => {
 			listeners.delete(listener);
-			if (listeners.size === 0) approvals.stop();
+			if (listeners.size === 0) {
+				approvals.stop();
+				triggers.stop();
+			}
 		};
 	};
 	const wrap = (permdock) => {
@@ -596,6 +680,7 @@ function createClientStore(options) {
 				reset();
 				tenant = options.tenant;
 				snapshot = emptySnapshot();
+				cleared = true;
 				instance = fromSnapshot(snapshot, compact({ tenant }));
 				base = "server-only";
 				approvals.forget();
@@ -679,6 +764,7 @@ function createClientStore(options) {
 			generation += 1;
 			batch.clear();
 			approvals.forget();
+			triggers.stop();
 			listeners.clear();
 		},
 		requestApproval: approvals.request
@@ -688,7 +774,10 @@ function createClientStore(options) {
 }
 //#endregion
 //#region src/client/store-options.ts
-/** One hint per store: the first check `endpoint: false` turns into a `server-only` denial. */
+/**
+* One hint per store: the first check `endpoint: false` turns into a
+* `server-only` denial.
+*/
 function hintOnce() {
 	let shown = false;
 	return (permission) => {
@@ -723,8 +812,9 @@ function adapterStore(options, snapshot, native) {
 		stale: native?.stale,
 		onSnapshot: both(native?.onSnapshot, options.onSnapshot),
 		onClear: both(native?.onClear, options.onClear),
-		approvalInterval: options.approvalInterval
+		approvalInterval: options.approvalInterval,
+		refreshOn: options.refreshOn
 	}));
 }
 //#endregion
-export { isPromiseLike as i, storeOf as n, isJws as r, adapterStore as t };
+export { isPromiseLike as a, isJws as i, storeOf as n, eventSourceRefresh as r, adapterStore as t };

package/dist/stores-C0Kta5Ft.d.ts

@@ -0,0 +1,59 @@
+import { Ln as Decision, j as PolicyVocabulary, or as Membership } from "./policy-types-CCiDRZBH.js";
+import { u as Permission } from "./permission-types-CAY-GU7e.js";
+import { r as Role } from "./vocabulary-DEJ5j4mR.js";
+import { d as UncheckedData, s as RowData } from "./permdock-B6Sf4T_S.js";
+import { r as DescribeOptions, t as DecisionDescription } from "./describe-ByS9LgHK.js";
+import { n as ProtectedAction } from "./action-result-CL-QCITA.js";
+import { a as FilterResult, c as PermissionSet, h as TenantView, l as PermissionState, m as SubjectView, o as GateMode, p as RolesOptions, r as ClientPermDock, s as GateView, t as ApprovalHandle } from "./types-B_d_g7T3.js";
+import { n as ProtectedActionReadable, r as SveltePermDockOptions } from "./types-djVzLlIV.js";
+import { Readable } from "svelte/store";
+//#region src/svelte/stores.d.ts
+declare function setPermDock(options: SveltePermDockOptions): ClientPermDock;
+declare function getPermDock<V extends PolicyVocabulary = PolicyVocabulary>(): ClientPermDock<V>;
+/**
+ * `describe` with the provider's `messages`; a call's own `messages` win. Call
+ * it during component init.
+ */
+declare function getDescribe(): (decision: Decision, options?: DescribeOptions) => DecisionDescription;
+declare function permission<D>(reference: Permission, data?: () => UncheckedData<D>): Readable<PermissionState>;
+declare function permission<P extends Permission>(reference: P, data?: () => RowData<P>): Readable<PermissionState>;
+/**
+ * What a permission-gated control renders, as `useGate` in React: `hidden`,
+ * `disabled`, `needsApproval`, `upgrade` and a `reason` in the provider's
+ * `messages`. Call it during component initialisation.
+ */
+declare function gate<D>(reference: Permission, data?: () => UncheckedData<D>, options?: {
+  readonly mode?: GateMode;
+}): Readable<GateView>;
+declare function gate<P extends Permission>(reference: P, data?: () => RowData<P>, options?: {
+  readonly mode?: GateMode;
+}): Readable<GateView>;
+declare function permissions(references: () => readonly Permission[], data?: () => unknown): Readable<PermissionSet>;
+declare function filtered<T>(reference: Permission<string, NoInfer<T>, "instance">, rows: () => readonly T[]): Readable<FilterResult<T>>;
+declare function tenant(): Readable<TenantView>;
+declare function memberships(): Readable<readonly Membership[]>;
+declare function roles(options?: () => RolesOptions): Readable<{
+  readonly roles: readonly Role[];
+}>;
+declare function assignable(): Readable<readonly Role[]>;
+type AssignableOptions = {
+  readonly tenant?: string;
+} | (() => {
+  readonly tenant?: string;
+});
+declare function assignablePermissions(options?: AssignableOptions): Readable<readonly Permission[]>;
+declare function subject(): Readable<SubjectView>;
+declare function approval(decision: () => Decision): Readable<ApprovalHandle>;
+/**
+ * A `protectAction` server action wired to a control, as `useProtectedAction`
+ * in React: a readable store of `gate`, `result`, `pending` and `approval`,
+ * with `run` and `retry`. Call it during component initialisation.
+ */
+declare function protectedAction<T, D>(action: ProtectedAction<T>, reference: Permission, data?: () => UncheckedData<D>, options?: {
+  readonly mode?: GateMode;
+}): ProtectedActionReadable<T>;
+declare function protectedAction<T, P extends Permission>(action: ProtectedAction<T>, reference: P, data?: () => RowData<P>, options?: {
+  readonly mode?: GateMode;
+}): ProtectedActionReadable<T>;
+//#endregion
+export { gate as a, memberships as c, protectedAction as d, roles as f, tenant as h, filtered as i, permission as l, subject as m, assignable as n, getDescribe as o, setPermDock as p, assignablePermissions as r, getPermDock as s, approval as t, permissions as u };

package/dist/{stores-CGhM8BN_.js → stores-DxZWDXCs.js}

@@ -1,6 +1,7 @@
-import { a as livePermDock, c as rolesView, d as subjectView, f as tenantView, n as describeWith, o as permissionSet, r as filterResult, t as approvalHandle } from "./views-DTIIO-oQ.js";
-import { n as getUi, r as providePermDock, t as getStore } from "./context-B_u3_bDJ.js";
-import { readable, toStore } from "svelte/store";
+import { n as actionRunner, t as actionApproval } from "./protected-action-DUYqb-Ma.js";
+import { a as livePermDock, c as rolesView, d as subjectView, f as tenantView, i as gateView, n as describeWith, o as permissionSet, r as filterResult, t as approvalHandle } from "./views-CD8wuL4Z.js";
+import { n as getUi, r as providePermDock, t as getStore } from "./context-BnIzxTNE.js";
+import { derived, readable, toStore, writable } from "svelte/store";
 //#region src/svelte/stores.ts
 function fromStore(store, compute) {
 	return readable(compute(), (set) => {
@@ -23,7 +24,10 @@ function setPermDock(options) {
 function getPermDock() {
 	return sveltePermDock(getStore());
 }
-/** `describe` with the provider's `messages`; a call's own `messages` win. Call it during component init. */
+/**
+* `describe` with the provider's `messages`; a call's own `messages` win. Call
+* it during component init.
+*/
 function getDescribe() {
 	return describeWith(getUi().messages);
 }
@@ -33,6 +37,16 @@ function permission(reference, data) {
 function permissionFor(store, reference, data) {
 	return fromStore(store, () => store.permissionState(reference, data?.()));
 }
+function gate(reference, data, options = {}) {
+	return gateFor(getStore(), reference, data, {
+		...options,
+		describe: getDescribe()
+	});
+}
+function gateFor(store, reference, data, options = {}) {
+	const describeDecision = options.describe ?? describeWith(void 0);
+	return fromStore(store, () => gateView(store.permissionState(reference, data?.()), (decision) => describeDecision(decision, { permission: reference }), options.mode));
+}
 function permissions(references, data) {
 	return permissionsFor(getStore(), references, data);
 }
@@ -87,5 +101,28 @@ function approval(decision) {
 function approvalFor(store, decision) {
 	return fromStore(store, () => approvalHandle(store, decision()));
 }
+function protectedAction(action, reference, data, options = {}) {
+	return protectedActionFor(getStore(), action, reference, data, {
+		...options,
+		describe: getDescribe()
+	});
+}
+function protectedActionFor(store, action, reference, data, options = {}) {
+	const state = writable({
+		result: void 0,
+		pending: false
+	});
+	const runner = actionRunner(() => action, state.set);
+	return {
+		subscribe: derived([gateFor(store, reference, data, options), state], ([gated, current]) => ({
+			gate: gated,
+			result: current.result,
+			pending: current.pending,
+			approval: actionApproval(store, current.result)
+		})).subscribe,
+		run: runner.run,
+		retry: runner.retry
+	};
+}
 //#endregion
-export { getDescribe as a, permission as c, setPermDock as d, subject as f, filtered as i, permissions as l, assignable as n, getPermDock as o, tenant as p, assignablePermissions as r, memberships as s, approval as t, roles as u };
+export { gate as a, memberships as c, protectedAction as d, roles as f, tenant as h, filtered as i, permission as l, subject as m, assignable as n, getDescribe as o, setPermDock as p, assignablePermissions as r, getPermDock as s, approval as t, permissions as u };

package/dist/{stream-CvdUS9V1.js → stream-CDvF0sJm.js}

@@ -1,4 +1,4 @@
-import { r as PermDockRevokedError } from "./errors-BKy0EfhN.js";
+import { r as PermDockRevokedError } from "./errors-B6R_lg2a.js";
 //#region src/server/stream.ts
 function isAsyncIterable(value) {
 	return value !== null && typeof value === "object" && typeof value[Symbol.asyncIterator] === "function";
@@ -35,8 +35,8 @@ async function* guardIterable(source, connection, options) {
 	}
 }
 /**
-* The connection loader for a stream `protect` already admitted: the first
-* read returns the row `protect` loaded, and each revalidation reloads it.
+* The connection loader for a stream `protect` already admitted: the first read
+* returns the row `protect` loaded, and each revalidation reloads it.
 */
 function reloadAfter(loaded, load) {
 	let first = true;
@@ -51,8 +51,8 @@ function reloadAfter(loaded, load) {
 /** WebSocket close code for a policy violation (RFC 6455 section 7.4.1). */
 const POLICY_VIOLATION = 1008;
 /**
-* The close reason for a problem: its PermDock type URI, or its `detail`
-* code for an `about:blank` one. RFC 6455 caps a reason at 123 bytes.
+* The close reason for a problem: its PermDock type URI, or its `detail` code
+* for an `about:blank` one. RFC 6455 caps a reason at 123 bytes.
 */
 function closeReason(problem) {
 	return problem.type === "about:blank" ? problem.detail : problem.type;

package/dist/{stream-CeCMJmBB.d.ts → stream-ltuLdtTG.d.ts}

@@ -1,10 +1,11 @@
-import { w as Permission } from "./vocabulary-CN8H_9UF.js";
-import { o as ProtectOptions } from "./server-types-CKQiCnON.js";
+import { u as Permission } from "./permission-types-CAY-GU7e.js";
+import { o as ProtectOptions } from "./server-types-CIlpSA2G.js";
 //#region src/server/stream.d.ts
 type StreamProtectOptions = ProtectOptions & {
   /**
    * For a procedure that returns an async iterable: each outbound item is
-   * checked against this permission and dropped when the subscriber cannot read it.
+   * checked against this permission and dropped when the subscriber cannot read
+   * it.
    */
   readonly items?: Permission<string, unknown, "instance">;
 };

package/dist/{style-DiKWnAvn.js → style-DblOtSga.js}

@@ -1 +1 @@
-export { t as createStyle, n as streamHasColors } from "./style-Uao76wO7.js";
+export { t as createStyle, n as streamHasColors } from "./style-Ds11Hmk4.js";

package/dist/{style-Uao76wO7.js → style-Ds11Hmk4.js}

@@ -7,12 +7,14 @@ function createStyle(color) {
 		paint,
 		errorMark: color ? paint("red", "✖") : "error",
 		warnMark: color ? paint("yellow", "⚠") : "warn",
+		infoMark: color ? paint("cyan", "ℹ") : "info",
 		okMark: color ? paint("green", "✔") : "ok"
 	};
 }
 /**
 * Whether a stream takes colour. On a TTY `hasColors()` honours `NO_COLOR`,
-* `FORCE_COLOR` and `TERM`; a pipe colours only under a non-zero `FORCE_COLOR`.
+* `FORCE_COLOR` and `TERM`; a pipe colours only under a non-zero
+* `FORCE_COLOR`.
 */
 function streamHasColors(stream, env = process.env) {
 	if (stream.isTTY === true) return stream.hasColors(env);

package/dist/{subject-settings-CkEwrw3W.js → subject-settings-8sH5HlII.js}

@@ -28,7 +28,10 @@ const DENIED = Object.freeze({
 function rowCheckOf(found, granted) {
 	return found ? granted ? GRANTED : DENIED : MISSING;
 }
-/** Reads `select <filter> as granted ... where <key> limit 2`; only a boolean `true` or `1` grants. */
+/**
+* Reads `select <filter> as granted ... where <key> limit 2`; only a boolean
+* `true` or `1` grants.
+*/
 function rowCheckFrom(rows) {
 	if (rows.length > 1) throw new Error("PermDock: checkRow key matches more than one row");
 	const [row] = rows;
@@ -88,9 +91,10 @@ function setConfigs(settings) {
 	}];
 }
 /**
-* The transaction preamble that makes Postgres see `permdock.subject`: one `select set_config(…)`
-* that sets the role, then the claims the generated policies read. Runs inside the caller's
-* transaction, so every setting is local to it.
+* The transaction preamble that makes Postgres see `permdock.subject`: one
+* `select set_config(…)` that sets the role, then the claims the generated
+* policies read. Runs inside the caller's transaction, so every setting is
+* local to it.
 */
 function subjectStatements(permdock, options = {}) {
 	const principal = permdock.subject.principal;