permdock 0.7.0 → 0.8.0

package/dist/supabase-hook-H-MtE9Wd.js

@@ -0,0 +1 @@
+export { i as runSupabase } from "./supabase-hook-B-yXnzUl.js";

package/dist/{supautils-MESd81bF.js → supautils-BU-pAEpf.js}

@@ -1,20 +1,22 @@
-import { c as listPermissions, u as renamedKeys } from "./permission-registry-DpPtSKNZ.js";
-import { f as scopeList, s as resolveScope } from "./scopes-BHsc-wp-.js";
-import { o as flattenGrantee } from "./grantee-BrRANrpT.js";
-import { c as policyLevels } from "./policy-DaJy4nK4.js";
-import { a as describeError, i as configError } from "./errors-DpP_U6Bf.js";
-import { d as sqlTextArray, i as qualifySqlTable } from "./sql-B96movIM.js";
-import "./budget-NbEtbJC_.js";
-import { l as roleColumn } from "./sources-B-zYB4GS.js";
+import { c as listPermissions, u as renamedKeys } from "./permission-registry-B8tYxPIt.js";
+import { f as scopeList, s as resolveScope } from "./scopes-0Up_UA2t.js";
+import { o as flattenGrantee } from "./grantee-Dke-9rd1.js";
+import { l as policyLevels } from "./policy-CLQ8__GF.js";
+import { a as describeError, i as configError } from "./errors-Vpu6rKHl.js";
+import { d as sqlTextArray, i as qualifySqlTable } from "./sql-0WjxIp9g.js";
+import "./budget-BELja5A9.js";
+import { l as roleColumn } from "./sources-CMAM-2A3.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
-import { c as parseSplit } from "./output-files-CCMdcFWb.js";
-import { x as resolveAuthorize } from "./supabase-hook-Dg0SrQWR.js";
-import { A as quoteQualified, C as parseMembershipsFlag, D as qualified, L as tenantTypeOf, O as quoteIdent, a as customRolesOn, j as quoteTable, k as quoteLiteral, t as CUSTOM_ROLES } from "./shared-fMKOv8hP.js";
-import { D as byKey, E as byCodeUnit, I as roleNames, M as assignableRoles, T as rolesTableScope, U as graphSqlName, b as tokenScopesPlan, j as apiKeysPlan, ot as checkSuspension, r as unsatisfiedKinds, t as ownershipRules, w as currentKeyExpr } from "./ownership-Z2LpxsGa.js";
+import { c as parseSplit } from "./output-files-BIQ_9pIs.js";
+import { b as resolveAuthorize } from "./supabase-hook-B-yXnzUl.js";
+import { A as quoteQualified, C as parseMembershipsFlag, D as qualified, F as firstScopeType, O as quoteIdent, R as tenantTypeOf, a as customRolesOn, j as quoteTable, k as quoteLiteral, s as signedIn, t as CUSTOM_ROLES } from "./shared-Afctg7B0.js";
+import { G as byKey, H as rolesTableScope, O as tokenScopesPlan, Q as graphSqlName, V as raiseSql, W as byCodeUnit, Y as apiKeysPlan, a as closureDepths, bt as checkSuspension, i as tablelessResources, o as graphPlan, r as tableNames, t as resolveVias, z as currentKeyExpr } from "./tables-DeMNEy6V.js";
+import { o as assignableRoles, r as unsatisfiedKinds, t as ownershipRules, u as roleNames } from "./ownership-B4L59T9u.js";
 import { t as membershipSourcesOf } from "./sources-qoIJQrJv.js";
-import { i as group, o as sqlStatements } from "./deciding-columns-DRo2QM6E.js";
-import { c as branchClauses, i as orSql } from "./policies-B2lZIurj.js";
-import { d as tableNames, f as tablelessResources, i as graphPlan, l as resolveVias, r as closureDepths, x as tableFor } from "./verify-pe8rL_Qw.js";
+import { i as group, o as sqlStatements } from "./deciding-columns-NB4wcyBf.js";
+import { t as resolveNames } from "./resolve-names-CF7xXLSG.js";
+import { d as orSql, h as branchClauses } from "./fields-D0vUI6dq.js";
+import { m as tableFor } from "./verify-DZeqoWu5.js";
 //#region src/cli/rls/custom-role-rebuild.ts
 const PREFIX = "PermDock CLI";
 /** A column of the roles-table row `r`. */
@@ -24,7 +26,10 @@ function col(name) {
 function schemaOf(table) {
 	return table.includes(".") ? beforeFirst(table, ".") : "public";
 }
-/** The roles-table column a reference joins on, after checking it points at `roles`. */
+/**
+* The roles-table column a reference joins on, after checking it points at
+* `roles`.
+*/
 function roleRef(role, table, roles, label) {
 	const pairs = Object.entries(role.on);
 	const [pair] = pairs;
@@ -104,9 +109,9 @@ function rebuildPlan(ctx, from, migrate) {
 	const iRef = i === void 0 || iTable === void 0 ? void 0 : roleRef(i.role, i.table, roles, "rls.customRoles.from.includes.role");
 	const included = i === void 0 || iTable === void 0 ? void 0 : sourceSql(i.include, iTable, "rls.customRoles.from.includes.include");
 	const refs = [`${col(pRef.id)} as permissions_ref`, ...iRef === void 0 ? [] : [`${col(iRef.id)} as includes_ref`]].join(", ");
-	const includeBlock = i === void 0 || iTable === void 0 || iRef === void 0 || included === void 0 ? "    v_include := null;" : `    with raw as (
+	const includeBlock = (rows) => i === void 0 || iTable === void 0 || iRef === void 0 || included === void 0 || rows === void 0 ? "    v_include := null;" : `    with raw as (
       select ${included} as role
-      from ${quoteTable(iTable)} x
+      from ${rows}
       where x.${quoteIdent(iRef.ref)} = v.includes_ref
     ),
     judged as (
@@ -125,9 +130,9 @@ function rebuildPlan(ctx, from, migrate) {
     into v_include, v_lost
     from judged j;
     v_dropped := v_dropped || coalesce(v_lost, '{}'::text[]);`;
-	const collect = `    with raw as (
+	const permissionsBlock = (rows) => `    with raw as (
       select ${legacy} as legacy, ${effect} as effect, ${level} as level
-      from ${quoteTable(pTable)} x
+      from ${rows}
       where x.${quoteIdent(pRef.ref)} = v.permissions_ref
     ),
     mapped as (
@@ -147,8 +152,9 @@ function rebuildPlan(ctx, from, migrate) {
       array_agg(v.role || ': ' || coalesce(j.legacy, 'null') || ', ' || j.dropped) filter (where j.dropped is not null)
     into v_allow, v_deny, v_lost
     from judged j;
-    v_dropped := v_dropped || coalesce(v_lost, '{}'::text[]);
-${includeBlock}`;
+    v_dropped := v_dropped || coalesce(v_lost, '{}'::text[]);`;
+	const legacyRows = iTable === void 0 ? void 0 : `${quoteTable(iTable)} x`;
+	const newRow = "(select new.*) x";
 	return {
 		rolesTable,
 		identity: `select ${tenant} as tenant_id, ${scope} as scope, ${scopeId} as scope_id, ${col(roles.key)}::text as role, ${refs}`,
@@ -156,7 +162,15 @@ ${includeBlock}`;
 		permsRef: pRef,
 		includesRef: iRef,
 		scopes,
-		collect,
+		collect: `${permissionsBlock(`${quoteTable(pTable)} x`)}
+${includeBlock(legacyRows)}`,
+		collectNew: {
+			permissions: `${permissionsBlock(newRow)}
+    v_include := null;`,
+			includes: `    v_allow := null;
+    v_deny := null;
+${includeBlock(newRow)}`
+		},
 		replace,
 		perms,
 		includes,
@@ -164,7 +178,10 @@ ${includeBlock}`;
 		roles
 	};
 }
-/** `v_dropped` grouped per legacy role (`role: a, b; other: c`), capped at 50 entries. */
+/**
+* `v_dropped` grouped per legacy role (`role: a, b; other: c`), capped at 50
+* entries.
+*/
 const DROPPED_LIST = `(select string_agg(g.role || ': ' || g.items, '; ' order by g.role)
     from (
       select split_part(l.d, ': ', 1) as role, string_agg(substr(l.d, strpos(l.d, ': ') + 2), ', ' order by l.d) as items
@@ -176,14 +193,20 @@ const DROPPED_LIST = `(select string_agg(g.role || ': ' || g.items, '; ' order b
 /**
 * `rls.customRoles.from.sync: 'trigger'`: after-row triggers on the legacy
 * permissions table, and on the includes table when mapped, rebuild each
-* affected role through `permdock_trusted_replace_custom_role_grants`, with
-* the same reads the backfill uses. An entry outside the ceiling is dropped
-* with a warning rather than aborting the legacy write, and a tenant role
-* whose name a shared role holds is skipped with a warning (`name-taken`).
+* affected role through `permdock_trusted_replace_custom_role_grants`, with the
+* same reads the backfill uses. An entry outside the ceiling is dropped with a
+* warning rather than aborting the legacy write, and a tenant role whose name a
+* shared role holds is skipped with a warning (`name-taken`). Before-row
+* triggers hold a signed-in caller at trigger depth 1 to the checks of
+* `permdock_replace_custom_role_grants`: `permdock_custom_role_guard` on each
+* role the row names, then `permdock_custom_role_beyond` on the entry it adds;
+* a refusal aborts the write.
 */
 function customRoleSyncSql(ctx, from, migrate) {
 	const plan = rebuildPlan(ctx, from, migrate);
 	const shared = qualified(ctx, CUSTOM_ROLES.shared);
+	const guard = qualified(ctx, CUSTOM_ROLES.guard);
+	const beyond = qualified(ctx, CUSTOM_ROLES.beyond);
 	const keepIncludes = plan.includesRef === void 0 ? `
     v_include := array(select c.include_role from ${plan.includes} c where c.tenant_id is not distinct from v.tenant_id and c.scope = v.scope and c.scope_id is not distinct from v.scope_id and c.role = v.role);` : "";
 	const one = (name, table, ref) => {
@@ -238,13 +261,80 @@ create trigger ${quoteIdent(trigger)}
   after insert or update or delete on ${target}
   for each row execute function ${fn}();`;
 	};
-	const chunks = [`-- rls.customRoles.from.sync: a write to the application's role tables rebuilds the role's PermDock grants`, one("permissions", from.permissions.table, plan.permsRef)];
-	if (from.includes !== void 0 && plan.includesRef !== void 0) chunks.push(one("includes", from.includes.table, plan.includesRef));
+	const guardOne = (name, table, ref) => {
+		const fn = qualified(ctx, `${CUSTOM_ROLES.syncGuard}_${name}`);
+		const target = quoteTable(qualifySqlTable(table));
+		const trigger = `${CUSTOM_ROLES.syncGuard}_${name}`;
+		return `create or replace function ${fn}()
+returns trigger
+language plpgsql
+volatile
+security definer
+set search_path = ''
+as $$
+declare
+  v record;
+  v_allow text[];
+  v_deny text[];
+  v_include text[];
+  v_lost text[];
+  v_dropped text[];
+  v_beyond text;
+  v_refs text[] := array[
+    case when tg_op <> 'INSERT' then old.${quoteIdent(ref.ref)}::text end,
+    case when tg_op <> 'DELETE' then new.${quoteIdent(ref.ref)}::text end
+  ];
+begin
+  if not (${signedIn(ctx)} and pg_trigger_depth() = 1) then
+    return coalesce(new, old);
+  end if;
+  for v in
+    ${plan.identity}
+    from ${plan.rolesTable} r
+    where ${plan.eligible} and r.${quoteIdent(ref.id)}::text = any(v_refs)
+  loop
+    if v.role is null or not (v.scope = 'global' or v.scope = any(${plan.scopes})) then
+      continue;
+    end if;
+    if v.tenant_id is not null and ${shared}(v.scope, v.role) then
+      continue;
+    end if;
+    perform ${guard}(v.tenant_id, v.scope, v.scope_id, v.role);
+    if tg_op = 'DELETE' then
+      continue;
+    end if;
+    v_dropped := '{}'::text[];
+${plan.collectNew[name]}
+    select string_agg(b, ', ' order by b) into v_beyond
+    from ${beyond}(v.tenant_id, v.scope, v.scope_id, v_allow, v_deny, v_include) b;
+    if v_beyond is not null then
+${raiseSql("      ", "42501", `'permdock: ' || v.role || ' would allow ' || v_beyond || ', which the caller may not hand out'`, "not-assignable-by")}
+    end if;
+  end loop;
+  return coalesce(new, old);
+end;
+$$;
+revoke execute on function ${fn}() from public, anon, authenticated;
+drop trigger if exists ${quoteIdent(trigger)} on ${target};
+create trigger ${quoteIdent(trigger)}
+  before insert or update or delete on ${target}
+  for each row execute function ${fn}();`;
+	};
+	const chunks = [
+		`-- rls.customRoles.from.sync: a write to the application's role tables rebuilds the role's PermDock grants`,
+		one("permissions", from.permissions.table, plan.permsRef),
+		`-- a signed-in caller writes only what the guarded replace would accept`,
+		guardOne("permissions", from.permissions.table, plan.permsRef)
+	];
+	if (from.includes !== void 0 && plan.includesRef !== void 0) chunks.push(one("includes", from.includes.table, plan.includesRef), guardOne("includes", from.includes.table, plan.includesRef));
 	return `${chunks.join("\n\n")}\n`;
 }
 //#endregion
 //#region src/cli/rls/generate-context.ts
-/** The scopes an `rls.migrate` `role` helper names, so `rls generate` writes their role-filtered member helper. */
+/**
+* The scopes an `rls.migrate` `role` helper names, so `rls generate` writes
+* their role-filtered member helper.
+*/
 function roleMemberScopesOf(migrate) {
 	const scopes = [...new Set(Object.values(migrate?.helpers ?? {}).flatMap((helper) => helper.form === "role" ? [helper.scope] : []))].toSorted();
 	return scopes.length === 0 ? {} : { roleMemberScopes: scopes };
@@ -285,7 +375,10 @@ function skippedOwnershipTriggers(triggers, scopes) {
 		return name;
 	});
 }
-/** The SQL context every emitter reads, from the flags, `rls` config and the policy. */
+/**
+* The SQL context every emitter reads, from the flags, `rls` config and the
+* policy.
+*/
 function buildContext(input, policy, options) {
 	const rls = input.config.rls;
 	const memberships = parseMembershipsFlag(input.memberships) ?? rls?.memberships;
@@ -342,8 +435,7 @@ function buildContext(input, policy, options) {
 		schema,
 		authorize,
 		roleClaim: rls?.roleClaim ?? "user_role",
-		tenantType: input.tenantType ?? rls?.tenantType ?? "uuid",
-		...rls?.teamType === void 0 ? {} : { teamType: rls.teamType },
+		tenantType: input.tenantType ?? firstScopeType(rls?.scopeTypes, scopes),
 		...rls?.scopeTypes === void 0 ? {} : { scopeTypes: rls.scopeTypes },
 		...memberships === void 0 ? {} : { memberships },
 		...sources === void 0 || sources.length === 0 ? {} : { sources },
@@ -388,8 +480,14 @@ function buildContext(input, policy, options) {
 	}
 	const [unsatisfied] = unsatisfiedKinds(ctx, policy);
 	if (unsatisfied !== void 0) return { refusal: `role ${unsatisfied.role} is for ${unsatisfied.for.join(", ")}, but its membership sources hold ${unsatisfied.sources.join(", ")}: no membership can hold it; set via on a source to one of those kinds` };
+	const names = resolveNames(policy, input.config, {
+		schema,
+		gucPrefix: ctx.gucPrefix,
+		tenantClaim: ctx.tenantClaim
+	});
 	return {
 		ctx,
+		names,
 		graph,
 		ownership,
 		schema,
@@ -413,21 +511,30 @@ function generateOptions(input) {
 		revokeColumns
 	};
 }
-/** Whether `--split` names `part`, which then leaves the helpers or the warnings. */
+/**
+* Whether `--split` names `part`, which then leaves the helpers or the
+* warnings.
+*/
 function splitsPart(raw, part) {
 	const split = parseSplit(raw);
 	return typeof split !== "string" && split?.includes(part) === true;
 }
 //#endregion
 //#region src/cli/rls/rows.ts
-/** `permitted_<resource>_rows(p_permission)`: the resource's row ids the subject may act on with one permission. */
+/**
+* `permitted_<resource>_rows(p_permission)`: the resource's row ids the subject
+* may act on with one permission.
+*/
 function rowsHelper(resource) {
 	const name = graphSqlName(resource);
 	const helper = `permitted_${name ?? resource}_rows`;
 	if (name === void 0 || new TextEncoder().encode(`${helper}_for`).length > 63) throw configError(`PermDock CLI: rls.rowHelpers cannot name a helper for resource '${resource}'; use a SQL name of at most 45 bytes`);
 	return helper;
 }
-/** Every declared `<permission>@<level>` of an instance permission on a resource with levels. */
+/**
+* Every declared `<permission>@<level>` of an instance permission on a resource
+* with levels.
+*/
 function levelKeys(policy) {
 	const out = [];
 	for (const leaf of listPermissions(policy.vocabulary.permissions)) {
@@ -441,7 +548,10 @@ function levelKeys(policy) {
 	}
 	return out;
 }
-/** The branches a row check of a permission reads: its allows and denies, inserts included, for signed-in callers. */
+/**
+* The branches a row check of a permission reads: its allows and denies,
+* inserts included, for signed-in callers.
+*/
 function rowBranchesOf(branches, resource) {
 	const out = /* @__PURE__ */ new Map();
 	for (const branch of branches) {
@@ -450,7 +560,10 @@ function rowBranchesOf(branches, resource) {
 	}
 	return out;
 }
-/** What a branch asks of a row: the `with check` of an insert, which sees the new row, the `using` of every other command. */
+/**
+* What a branch asks of a row: the `with check` of an insert, which sees the
+* new row, the `using` of every other command.
+*/
 function clauseOf(branch) {
 	const clauses = branchClauses(branch);
 	return (branch.command === "insert" ? clauses.check : clauses.using) ?? "true";
@@ -573,9 +686,9 @@ ${rowSql(ctx, name, table, where)}`;
 ${forUserSql(ctx, qualified(ctx, `${name}_for`), fn)}`;
 }
 /**
-* `permitted_<resource>_rows(p_permission)` for each resource `select`
-* names (or every resource a grant reaches with `true`): the ids of its rows
-* the caller may read, update or delete with that permission, from the same
+* `permitted_<resource>_rows(p_permission)` for each resource `select` names
+* (or every resource a grant reaches with `true`): the ids of its rows the
+* caller may read, update or delete with that permission, from the same
 * compiled allows and denies the table policies use, so closure walks, link
 * hops, the restricted stop, `includes`, groups and `requires` all apply. A
 * `security definer` helper, so hand-written policies and functions call it
@@ -598,7 +711,10 @@ function rowHelpersSql(ctx, policy, branches, select, tables, warnings) {
 }
 //#endregion
 //#region src/cli/sql/supautils.ts
-/** `supautils.reserved_roles` of supabase/postgres 17.11.0.002 (supautils 3.4.4). */
+/**
+* `supautils.reserved_roles` of supabase/postgres 17.11.0.002 (supautils
+* 3.4.4).
+*/
 const RESERVED_ROLES = /* @__PURE__ */ new Set([
 	"supabase_admin",
 	"supabase_auth_admin",
@@ -615,7 +731,10 @@ const RESERVED_ROLES = /* @__PURE__ */ new Set([
 	"authenticated",
 	"anon"
 ]);
-/** The `*` entries of `reserved_roles`: `postgres` may still `set` or `reset` their settings. */
+/**
+* The `*` entries of `reserved_roles`: `postgres` may still `set` or `reset`
+* their settings.
+*/
 const CONFIGURABLE_ROLES = /* @__PURE__ */ new Set([
 	"service_role",
 	"authenticator",
@@ -672,9 +791,9 @@ function rejection(text) {
 	return role === void 0 ? void 0 : `grants membership in the reserved role ${role}`;
 }
 /**
-* The statements of `sql` that supautils rejects for a non-superuser:
-* changing or dropping a reserved role, other than `set` or `reset` on the
-* four API roles, and granting a reserved membership.
+* The statements of `sql` that supautils rejects for a non-superuser: changing
+* or dropping a reserved role, other than `set` or `reset` on the four API
+* roles, and granting a reserved membership.
 */
 function supautilsRejections(sql) {
 	return sqlStatements(sql).flatMap(({ line, text }) => {

package/dist/{support-session-Cna49-3f.js → support-session-BsmPCbz8.js}

@@ -1,12 +1,12 @@
 import { t as compact } from "./compact-CAf557ZB.js";
-import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { a as ownRecord } from "./paths-DXSHAMIa.js";
-import { a as isId, r as idList } from "./expiry-D4_YKRKD.js";
-import { n as internalsOf } from "./internals-Dk8A8fX3.js";
-import { c as listPermissions, m as annotationsFor, n as findPermission } from "./permission-registry-DpPtSKNZ.js";
-import { g as secondsOf, l as isRfc3339, m as rfc3339, p as nowSeconds } from "./time-DkWjdL98.js";
+import { n as freezeDeep } from "./freeze-jjan0lCv.js";
+import { a as ownRecord } from "./paths-CUvURzHp.js";
+import { a as isId, r as idList } from "./expiry-6XByK0dm.js";
+import { n as internalsOf } from "./internals-B3IgHrvo.js";
+import { c as listPermissions, m as annotationsFor, n as findPermission } from "./permission-registry-B8tYxPIt.js";
+import { g as secondsOf, l as isRfc3339, m as rfc3339, p as nowSeconds } from "./time-nR1JesoH.js";
 import { t as canonicalJson } from "./canonical-json-DwilZ1iB.js";
-import { r as sha256Digest } from "./sha256-D9ihqmvd.js";
+import { r as sha256Digest } from "./sha256-C-4WXKIu.js";
 //#region src/core/support-session.ts
 const DEFAULT_TTL = 3600;
 const MAX_TTL = 86400;
@@ -15,8 +15,8 @@ function isReason(value) {
 	return typeof value === "string" && value.trim().length > 0 && value.length <= MAX_REASON;
 }
 /**
-* Validates an untrusted support-session record and returns a frozen copy
-* with only the v1 fields, or `undefined`.
+* Validates an untrusted support-session record and returns a frozen copy with
+* only the v1 fields, or `undefined`.
 */
 function parseSupportSession(input) {
 	const value = ownRecord(input);
@@ -62,21 +62,21 @@ function sessionToken(request, actor, tenant, permissions, ttl) {
 	}));
 }
 /**
-* Decides whether the subject of `permdock` may start the support session
-* in `request`. The actor must be a signed-in person acting for themselves
+* Decides whether the subject of `permdock` may start the support session in
+* `request`. The actor must be a signed-in person acting for themselves
 * (`exceeds-creator` otherwise), give a `reason` (`reason-required`), be a
-* member of the tenant (`tenant-mismatch`) and be able to use every
-* permission (`exceeds-creator`). Without `permissions` the session gets the
-* actor's read-only permissions. The tenant's `supportSessions` policy then
-* applies, and the result is `approval-required` until `approved` carries
-* its token and `approvedBy` names someone other than the actor.
+* member of the tenant (`tenant-mismatch`) and be able to use every permission
+* (`exceeds-creator`). Without `permissions` the session gets the actor's
+* read-only permissions. The tenant's `supportSessions` policy then applies,
+* and the result is `approval-required` until `approved` carries its token and
+* `approvedBy` names someone other than the actor.
 */
 /**
-* Decides whether the subject of `permdock` may start the support session
-* in `request` and returns the record to sign: a stated reason, membership
-* of the tenant, the actor's own reach, the tenant's `supportSessions`
-* policy and approval by someone else. An instance built from a snapshot
-* denies with `unsupported`.
+* Decides whether the subject of `permdock` may start the support session in
+* `request` and returns the record to sign: a stated reason, membership of the
+* tenant, the actor's own reach, the tenant's `supportSessions` policy and
+* approval by someone else. An instance built from a snapshot denies with
+* `unsupported`.
 */
 function decideSupportSession(permdock, request, options = {}) {
 	const internals = internalsOf(permdock);

package/dist/svelte/PermissionBoundary.svelte

@@ -1,10 +1,6 @@
 <script lang="ts">
-  import {
-    boundaryDigest,
-    boundaryFallback,
-    type PermissionBoundaryProps,
-    type PermissionBoundaryState,
-  } from './runtime.js';
+  import { boundaryDigest, boundaryFallback } from './runtime.js';
+import type { PermissionBoundaryProps, PermissionBoundaryState } from './runtime.ts';
 
   let { children, denied, approval }: PermissionBoundaryProps = $props();
 

package/dist/svelte/Protected.svelte

@@ -1,14 +1,8 @@
 <script lang="ts">
   import { onDestroy } from 'svelte';
 
-  import {
-    getStore,
-    getUi,
-    scopedFor,
-    slotContent,
-    viewFor,
-    type ProtectedProps,
-  } from './runtime.js';
+  import { getStore, getUi, scopedFor, slotContent, viewFor } from './runtime.js';
+import type { ProtectedProps } from './runtime.ts';
 
   let {
     permission,

package/dist/svelte/index.d.ts

@@ -1,13 +1,14 @@
-import { n as requiredPlans } from "../problem-details-Tcfmj3bV.js";
-import { i as describe } from "../describe-O0SwYIK8.js";
-import { t as PermissionBoundaryState } from "../boundary-BmHxVH1J.js";
-import { t as approvalHeaders } from "../headers-CIbDTUTK.js";
-import { a as FilterResult, c as PermissionSet, d as RolesOptions, f as SubjectView, i as ClientStatus, l as PermissionState, n as ApprovalState, p as TenantView, r as ClientPermDock, t as ApprovalHandle } from "../types-CKV71kKh.js";
-import { n as SveltePermDockOptions, o as PermissionBoundaryProps, r as ProtectedProps, t as PermDockDefaults } from "../types-DXmwu78Z.js";
-import { a as getDescribe, c as permission, d as setPermDock, f as subject, i as filtered, l as permissions, n as assignable, o as getPermDock, p as tenant, r as assignablePermissions, s as memberships, t as approval, u as roles } from "../stores-BAZwSYZA.js";
+import { c as requiredPlans } from "../errors-zi_4T-rx.js";
+import { i as describe } from "../describe-ByS9LgHK.js";
+import { t as PermissionBoundaryState } from "../boundary-C9ck-3uK.js";
+import { n as ProtectedAction, t as ActionResult } from "../action-result-CL-QCITA.js";
+import { t as approvalHeaders } from "../headers-B9jQxjtW.js";
+import { a as FilterResult, b as eventSourceRefresh, c as PermissionSet, d as ProtectedActionView, h as TenantView, i as ClientStatus, l as PermissionState, m as SubjectView, n as ApprovalState, o as GateMode, p as RolesOptions, r as ClientPermDock, s as GateView, t as ApprovalHandle, v as EventSourceRefreshOptions, y as RefreshTrigger } from "../types-B_d_g7T3.js";
+import { i as ProtectedProps, n as ProtectedActionReadable, r as SveltePermDockOptions, s as PermissionBoundaryProps, t as PermDockDefaults } from "../types-djVzLlIV.js";
+import { a as gate, c as memberships, d as protectedAction, f as roles, h as tenant, i as filtered, l as permission, m as subject, n as assignable, o as getDescribe, p as setPermDock, r as assignablePermissions, s as getPermDock, t as approval, u as permissions } from "../stores-C0Kta5Ft.js";
 import { Component } from "svelte";
 //#region src/svelte/index.d.ts
 export declare const Protected: Component<ProtectedProps>;
 export declare const PermissionBoundary: Component<PermissionBoundaryProps>;
 //#endregion
-export { type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type FilterResult, type PermDockDefaults, type PermissionBoundaryProps, type PermissionBoundaryState, type PermissionSet, type PermissionState, type ProtectedProps, type RolesOptions, type SubjectView, type SveltePermDockOptions, type TenantView, approval, approvalHeaders, assignable, assignablePermissions, describe, filtered, getDescribe, getPermDock, memberships, permission, permissions, requiredPlans, roles, setPermDock, subject, tenant };
+export { type ActionResult, type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type EventSourceRefreshOptions, type FilterResult, type GateMode, type GateView, type PermDockDefaults, type PermissionBoundaryProps, type PermissionBoundaryState, type PermissionSet, type PermissionState, type ProtectedAction, type ProtectedActionReadable, type ProtectedActionView, type ProtectedProps, type RefreshTrigger, type RolesOptions, type SubjectView, type SveltePermDockOptions, type TenantView, approval, approvalHeaders, assignable, assignablePermissions, describe, eventSourceRefresh, filtered, gate, getDescribe, getPermDock, memberships, permission, permissions, protectedAction, requiredPlans, roles, setPermDock, subject, tenant };

package/dist/svelte/index.js

@@ -1,11 +1,12 @@
-import { r as requiredPlans } from "../problem-details-cn5X30gZ.js";
-import { t as describe } from "../describe-DZlnEtLy.js";
-import { n as boundaryFallback, t as boundaryDigest } from "../boundary-BM8a_P6E.js";
-import { t as approvalHeaders } from "../headers-BIjfMaoC.js";
-import { u as slotContent } from "../views-BB8E9dTP.js";
-import { n as getUi, t as getStore } from "../context--uM9V3Ui.js";
-import { n as viewFor, t as scopedFor } from "../runtime-Vif3_-zf.js";
-import { a as getDescribe, c as permission, d as setPermDock, f as subject, i as filtered, l as permissions, n as assignable, o as getPermDock, p as tenant, r as assignablePermissions, s as memberships, t as approval, u as roles } from "../stores-BqEuHC05.js";
+import { r as requiredPlans } from "../problem-details-CLDgX1KV.js";
+import { n as describe } from "../describe-Bb4hGK5d.js";
+import { n as boundaryFallback, t as boundaryDigest } from "../boundary-BV3O1eud.js";
+import { r as approvalHeaders } from "../protected-action-DUYqb-Ma.js";
+import { u as slotContent } from "../views-CD8wuL4Z.js";
+import { r as eventSourceRefresh } from "../store-options-Dil3lraY.js";
+import { n as getUi, t as getStore } from "../context-BnIzxTNE.js";
+import { n as viewFor, t as scopedFor } from "../runtime-BGnrOkVH.js";
+import { a as gate, c as memberships, d as protectedAction, f as roles, h as tenant, i as filtered, l as permission, m as subject, n as assignable, o as getDescribe, p as setPermDock, r as assignablePermissions, s as getPermDock, t as approval, u as permissions } from "../stores-DxZWDXCs.js";
 import "svelte/internal/disclose-version";
 import * as $ from "svelte/internal/client";
 import { onDestroy } from "svelte";
@@ -118,4 +119,4 @@ function Protected$1($$anchor, $$props) {
 const Protected = Protected$1;
 const PermissionBoundary = PermissionBoundary$1;
 //#endregion
-export { PermissionBoundary, Protected, approval, approvalHeaders, assignable, assignablePermissions, describe, filtered, getDescribe, getPermDock, memberships, permission, permissions, requiredPlans, roles, setPermDock, subject, tenant };
+export { PermissionBoundary, Protected, approval, approvalHeaders, assignable, assignablePermissions, describe, eventSourceRefresh, filtered, gate, getDescribe, getPermDock, memberships, permission, permissions, protectedAction, requiredPlans, roles, setPermDock, subject, tenant };

package/dist/svelte/runtime.d.ts

@@ -1,7 +1,7 @@
-import { n as DescribeMessages } from "../describe-O0SwYIK8.js";
-import { n as boundaryDigest, r as boundaryFallback, t as PermissionBoundaryState } from "../boundary-BmHxVH1J.js";
-import { m as ClientStore } from "../types-CKV71kKh.js";
-import { a as viewFor, i as scopedFor, o as PermissionBoundaryProps, r as ProtectedProps, s as slotContent, t as PermDockDefaults } from "../types-DXmwu78Z.js";
+import { n as DescribeMessages } from "../describe-ByS9LgHK.js";
+import { n as boundaryDigest, r as boundaryFallback, t as PermissionBoundaryState } from "../boundary-C9ck-3uK.js";
+import { g as ClientStore } from "../types-B_d_g7T3.js";
+import { a as scopedFor, c as slotContent, i as ProtectedProps, o as viewFor, s as PermissionBoundaryProps, t as PermDockDefaults } from "../types-djVzLlIV.js";
 //#region src/svelte/context.d.ts
 /** The provider's `defaults` and `messages`. */
 type PermDockUi = {

package/dist/svelte/runtime.js

@@ -1,5 +1,5 @@
-import { n as boundaryFallback, t as boundaryDigest } from "../boundary-BM8a_P6E.js";
-import { u as slotContent } from "../views-BB8E9dTP.js";
-import { n as getUi, t as getStore } from "../context--uM9V3Ui.js";
-import { n as viewFor, t as scopedFor } from "../runtime-Vif3_-zf.js";
+import { n as boundaryFallback, t as boundaryDigest } from "../boundary-BV3O1eud.js";
+import { u as slotContent } from "../views-CD8wuL4Z.js";
+import { n as getUi, t as getStore } from "../context-BnIzxTNE.js";
+import { n as viewFor, t as scopedFor } from "../runtime-BGnrOkVH.js";
 export { boundaryDigest, boundaryFallback, getStore, getUi, scopedFor, slotContent, viewFor };

package/dist/svelte/source.d.ts

@@ -1,13 +1,14 @@
-import { n as requiredPlans } from "../problem-details-Tcfmj3bV.js";
-import { i as describe } from "../describe-O0SwYIK8.js";
-import { t as PermissionBoundaryState } from "../boundary-BmHxVH1J.js";
-import { t as approvalHeaders } from "../headers-CIbDTUTK.js";
-import { a as FilterResult, c as PermissionSet, d as RolesOptions, f as SubjectView, i as ClientStatus, l as PermissionState, n as ApprovalState, p as TenantView, r as ClientPermDock, t as ApprovalHandle } from "../types-CKV71kKh.js";
-import { n as SveltePermDockOptions, o as PermissionBoundaryProps, r as ProtectedProps, t as PermDockDefaults } from "../types-DXmwu78Z.js";
-import { a as getDescribe, c as permission, d as setPermDock, f as subject, i as filtered, l as permissions, n as assignable, o as getPermDock, p as tenant, r as assignablePermissions, s as memberships, t as approval, u as roles } from "../stores-BAZwSYZA.js";
+import { c as requiredPlans } from "../errors-zi_4T-rx.js";
+import { i as describe } from "../describe-ByS9LgHK.js";
+import { t as PermissionBoundaryState } from "../boundary-C9ck-3uK.js";
+import { n as ProtectedAction, t as ActionResult } from "../action-result-CL-QCITA.js";
+import { t as approvalHeaders } from "../headers-B9jQxjtW.js";
+import { a as FilterResult, b as eventSourceRefresh, c as PermissionSet, d as ProtectedActionView, h as TenantView, i as ClientStatus, l as PermissionState, m as SubjectView, n as ApprovalState, o as GateMode, p as RolesOptions, r as ClientPermDock, s as GateView, t as ApprovalHandle, v as EventSourceRefreshOptions, y as RefreshTrigger } from "../types-B_d_g7T3.js";
+import { i as ProtectedProps, n as ProtectedActionReadable, r as SveltePermDockOptions, s as PermissionBoundaryProps, t as PermDockDefaults } from "../types-djVzLlIV.js";
+import { a as gate, c as memberships, d as protectedAction, f as roles, h as tenant, i as filtered, l as permission, m as subject, n as assignable, o as getDescribe, p as setPermDock, r as assignablePermissions, s as getPermDock, t as approval, u as permissions } from "../stores-C0Kta5Ft.js";
 import { Component } from "svelte";
 //#region src/svelte/source.d.ts
 export declare const Protected: Component<ProtectedProps>;
 export declare const PermissionBoundary: Component<PermissionBoundaryProps>;
 //#endregion
-export { type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type FilterResult, type PermDockDefaults, type PermissionBoundaryProps, type PermissionBoundaryState, type PermissionSet, type PermissionState, type ProtectedProps, type RolesOptions, type SubjectView, type SveltePermDockOptions, type TenantView, approval, approvalHeaders, assignable, assignablePermissions, describe, filtered, getDescribe, getPermDock, memberships, permission, permissions, requiredPlans, roles, setPermDock, subject, tenant };
+export { type ActionResult, type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type EventSourceRefreshOptions, type FilterResult, type GateMode, type GateView, type PermDockDefaults, type PermissionBoundaryProps, type PermissionBoundaryState, type PermissionSet, type PermissionState, type ProtectedAction, type ProtectedActionReadable, type ProtectedActionView, type ProtectedProps, type RefreshTrigger, type RolesOptions, type SubjectView, type SveltePermDockOptions, type TenantView, approval, approvalHeaders, assignable, assignablePermissions, describe, eventSourceRefresh, filtered, gate, getDescribe, getPermDock, memberships, permission, permissions, protectedAction, requiredPlans, roles, setPermDock, subject, tenant };

package/dist/svelte/source.js

@@ -1,11 +1,12 @@
-import { r as requiredPlans } from "../problem-details-cn5X30gZ.js";
-import { t as describe } from "../describe-DZlnEtLy.js";
-import { t as approvalHeaders } from "../headers-BIjfMaoC.js";
-import { a as getDescribe, c as permission, d as setPermDock, f as subject, i as filtered, l as permissions, n as assignable, o as getPermDock, p as tenant, r as assignablePermissions, s as memberships, t as approval, u as roles } from "../stores-BqEuHC05.js";
+import { r as requiredPlans } from "../problem-details-CLDgX1KV.js";
+import { n as describe } from "../describe-Bb4hGK5d.js";
+import { r as approvalHeaders } from "../protected-action-DUYqb-Ma.js";
+import { r as eventSourceRefresh } from "../store-options-Dil3lraY.js";
+import { a as gate, c as memberships, d as protectedAction, f as roles, h as tenant, i as filtered, l as permission, m as subject, n as assignable, o as getDescribe, p as setPermDock, r as assignablePermissions, s as getPermDock, t as approval, u as permissions } from "../stores-DxZWDXCs.js";
 import PermissionBoundaryComponent from "./PermissionBoundary.svelte";
 import ProtectedComponent from "./Protected.svelte";
 //#region src/svelte/source.ts
 const Protected = ProtectedComponent;
 const PermissionBoundary = PermissionBoundaryComponent;
 //#endregion
-export { PermissionBoundary, Protected, approval, approvalHeaders, assignable, assignablePermissions, describe, filtered, getDescribe, getPermDock, memberships, permission, permissions, requiredPlans, roles, setPermDock, subject, tenant };
+export { PermissionBoundary, Protected, approval, approvalHeaders, assignable, assignablePermissions, describe, eventSourceRefresh, filtered, gate, getDescribe, getPermDock, memberships, permission, permissions, protectedAction, requiredPlans, roles, setPermDock, subject, tenant };