permdock 0.0.0 → 0.1.0

package/dist/mcp/index.d.ts

@@ -0,0 +1,127 @@
+import { $ as DecisionSink, C as Policy, at as LimitStore, ct as MembershipSource, ft as RelationSource, hr as Subject, mr as Principal, pt as RoleSource, sn as PolicySource, tt as EntitlementSource, xt as SnapshotSource } from "../policy-CInmNGkM.js";
+import { d as Permission } from "../permissions-B4apnahQ.js";
+import { f as ApprovalStore } from "../types-B8w5PFtS.js";
+import { t as ApprovalHint } from "../errors-DbZ1YOnb.js";
+import { u as JwtSubjectOptions } from "../types-bva3i4Gf.js";
+import { o as OtelWrap } from "../types-B9dmiiab.js";
+import { CacheHint, Icon, McpServer, PromptCallback, ReadResourceCallback, ReadResourceTemplateCallback, RegisteredPrompt, RegisteredResource, RegisteredResourceTemplate, RegisteredTool, ResourceMetadata, ResourceTemplate, ScopeChallengeHandler, StandardSchemaWithJSON, ToolAnnotations, ToolCallback, Variables } from "@modelcontextprotocol/server";
+//#region src/mcp/types.d.ts
+/** The verified `AuthInfo` the MCP SDK's bearer auth puts on `ctx.http.authInfo`. */
+type McpAuthInfo = {
+  readonly token?: string;
+  readonly clientId?: string;
+  readonly scopes?: readonly string[];
+  readonly expiresAt?: number;
+  readonly resource?: URL;
+  /** Stamped by the SDK's bearer-auth helpers from their `resourceMetadataUrl` option. */
+  readonly resourceMetadataUrl?: string;
+  readonly extra?: Readonly<Record<string, unknown>>;
+};
+/** Base principal `subjectFromMcp` returns. */
+type McpPrincipal = Principal & {
+  readonly issuer?: string;
+  readonly claims?: Readonly<Record<string, unknown>>;
+};
+type InputOf<TInput> = TInput extends StandardSchemaWithJSON ? StandardSchemaWithJSON.InferOutput<TInput> : undefined;
+type Guard<TArgs extends readonly unknown[]> = {
+  readonly permission: Permission;
+  /** Loads the row to decide on; `null` or a throw denies. */
+  readonly data?: (...args: TArgs) => unknown;
+};
+type McpToolConfig<TInput extends StandardSchemaWithJSON | undefined = undefined, TOutput extends StandardSchemaWithJSON | undefined = undefined> = Guard<[args: InputOf<TInput>]> & {
+  readonly title?: string;
+  readonly description?: string;
+  readonly inputSchema?: TInput;
+  readonly outputSchema?: TOutput;
+  readonly annotations?: ToolAnnotations;
+  readonly icons?: Icon[];
+  readonly scopeChallenge?: ScopeChallengeHandler;
+  readonly _meta?: Record<string, unknown>;
+  /**
+   * Decide again when the handler resolves, without consuming quota, and
+   * return the refusal instead of the result unless the call is still
+   * allowed. The re-check withholds the result; it cannot undo the work.
+   */
+  readonly longRunning?: boolean;
+};
+type McpResourceConfig<TArgs extends readonly unknown[]> = Guard<TArgs> & ResourceMetadata & {
+  readonly cacheHint?: CacheHint;
+  readonly scopeChallenge?: ScopeChallengeHandler;
+};
+type McpPromptConfig<TArgs extends StandardSchemaWithJSON | undefined = undefined> = Guard<[args: InputOf<TArgs>]> & {
+  readonly title?: string;
+  readonly description?: string;
+  readonly argsSchema?: TArgs;
+  readonly icons?: Icon[];
+  readonly scopeChallenge?: ScopeChallengeHandler;
+  readonly _meta?: Record<string, unknown>;
+};
+/** `McpServer` whose `register*` methods take a `permission` and decide first. */
+type GuardedMcpServer = Omit<McpServer, "registerTool" | "registerResource" | "registerPrompt"> & {
+  registerTool<TInput extends StandardSchemaWithJSON | undefined = undefined, TOutput extends StandardSchemaWithJSON | undefined = undefined>(name: string, config: McpToolConfig<TInput, TOutput>, handler: ToolCallback<TInput>): RegisteredTool;
+  registerResource(name: string, uri: string, config: McpResourceConfig<[uri: URL]>, read: ReadResourceCallback): RegisteredResource;
+  registerResource(name: string, template: ResourceTemplate, config: McpResourceConfig<[uri: URL, variables: Variables]>, read: ReadResourceTemplateCallback): RegisteredResourceTemplate;
+  registerPrompt<TArgs extends StandardSchemaWithJSON | undefined = undefined>(name: string, config: McpPromptConfig<TArgs>, handler: PromptCallback<TArgs>): RegisteredPrompt;
+};
+type McpPermDockOptions<TUser = unknown> = {
+  /** Receives the verified auth info, or `{}` on a transport without one (stdio). */
+  readonly subject: (authInfo: McpAuthInfo) => TUser | Promise<TUser>;
+  readonly tenant?: string | ((authInfo: McpAuthInfo) => string | undefined | Promise<string | undefined>);
+  /** Deny every call and list nothing when the transport carries no auth info. */
+  readonly requireAuthInfo?: boolean;
+  /**
+   * This server's RFC 8707 resource identifier. A token whose
+   * `authInfo.resource` is absent or different is refused with `invalid_token`.
+   */
+  readonly resource?: string | URL;
+  /**
+   * Where a human approves. With `at` set, `approval-required` answers a
+   * client that supports URL elicitation with an `input_required` result.
+   */
+  readonly approval?: ApprovalHint;
+  /** Where the user re-authenticates; `acr_values` and `max_age` are appended to `at`. */
+  readonly stepUp?: {
+    readonly at: string;
+  };
+  /**
+   * Seals the approval token into `requestState`. Pass the codec from the
+   * SDK's `createRequestStateCodec` when the server verifies request state.
+   */
+  readonly requestState?: {
+    readonly mint: (token: string, context?: never) => Promise<string>;
+  };
+  readonly memberships?: MembershipSource | readonly MembershipSource[];
+  /** The object graph for relation grants that walk a parent chain; without it they deny. */
+  readonly relations?: RelationSource;
+  readonly entitlements?: EntitlementSource;
+  readonly customRoles?: RoleSource;
+  /** Hosted grants, read once per instance; see `PolicySource`. */
+  readonly policies?: PolicySource;
+  readonly store?: ApprovalStore;
+  readonly sink?: DecisionSink;
+  readonly limits?: LimitStore;
+  readonly snapshots?: SnapshotSource;
+  /** `(permdock) => withOtel(permdock, options)` from `permdock/otel`. */
+  readonly otel?: OtelWrap;
+};
+type McpPermDock = {
+  /** Call before registering anything: later `register*` calls must carry a `permission`. */
+  readonly protectServer: (server: McpServer) => GuardedMcpServer;
+};
+//#endregion
+//#region src/mcp/create.d.ts
+/** `_meta` key on `tools/call`, `resources/read` and `prompts/get` carrying an approval token. */
+export declare const APPROVAL_META_KEY = "dev.permdock/approval";
+export declare function createPermDock<TUser, TPrincipal extends Principal = Principal>(policy: Policy<TUser, TPrincipal>, options: McpPermDockOptions<TUser>): McpPermDock;
+//#endregion
+//#region src/mcp/subject.d.ts
+type McpSubjectOptions = Pick<JwtSubjectOptions, "claims" | "groupRoles" | "schema" | "delegation">;
+/**
+ * Maps the `AuthInfo` the MCP SDK's bearer verification produced to a
+ * `Subject`: the principal from the verified claims in `extra`, the client
+ * as an `mcp-client` actor, the granted scopes as the delegation. Never
+ * verifies and never throws; anything unusable is the anonymous subject.
+ */
+export declare function subjectFromMcp(authInfo: McpAuthInfo | undefined, options?: McpSubjectOptions): Subject<McpPrincipal>;
+//#endregion
+export type { GuardedMcpServer, McpAuthInfo, McpPermDock, McpPermDockOptions, McpPrincipal, McpPromptConfig, McpResourceConfig, McpSubjectOptions, McpToolConfig };

package/dist/mcp/index.js

@@ -0,0 +1,563 @@
+import { t as compact } from "../compact-y6vfu2_f.js";
+import { n as freezeDeep } from "../freeze-y1_jQL4v.js";
+import { t as annotationsFor } from "../permissions-DC7GROPA.js";
+import { t as describe } from "../describe-Bt1YD5uS.js";
+import { s as wireDenials } from "../errors-Iy71s7Oj.js";
+import { t as createPermDock$1 } from "../permdock-yoZ7EjxX.js";
+import { t as anonymousSubject } from "../subject-C6dLxqHU.js";
+import { t as mayUse } from "../may-use-CnFEjVEp.js";
+import { l as storedApprovalToken, s as resumeDecision } from "../helpers-DnSOrhB9.js";
+import { n as mapClaimsToSubject } from "../map-claims-B_6I1Rn-.js";
+import { c as stepUpOf, r as bearerChallenge, s as protectedResourceMetadataUrl } from "../problem-Cgp9-KZA.js";
+import { t as boundedMap } from "../lru-8q4WZjBV.js";
+//#region src/mcp/create.ts
+/** `_meta` key on `tools/call`, `resources/read` and `prompts/get` carrying an approval token. */
+const APPROVAL_META_KEY = "dev.permdock/approval";
+const SESSIONS_PER_SERVER = 1e3;
+const CLIENT_CAPABILITIES = "io.modelcontextprotocol/clientCapabilities";
+/** What a completion re-check still accepts after the handler ran. */
+function stillAllowed(decision, approved) {
+	switch (decision.outcome) {
+		case "granted": return true;
+		case "approval-required": return approved !== void 0 && decision.token === approved;
+		case "denied": return decision.denials.length > 0 && decision.denials.every((denial) => denial.reason === "limit");
+		default: return decision;
+	}
+}
+function isRecord$1(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function contextOf(value) {
+	return isRecord$1(value) ? value : {};
+}
+function approvalTokenOf(context) {
+	let fromState;
+	try {
+		fromState = context.mcpReq?.requestState?.();
+	} catch {
+		fromState = void 0;
+	}
+	if (typeof fromState === "string" && fromState !== "") return fromState;
+	const fromMeta = context.mcpReq?._meta?.[APPROVAL_META_KEY];
+	if (typeof fromMeta === "string" && fromMeta !== "") return fromMeta;
+	const fromAuth = context.http?.authInfo?.extra?.["approval"];
+	return typeof fromAuth === "string" && fromAuth !== "" ? fromAuth : void 0;
+}
+function authorizationDetailsOf(authInfo) {
+	const details = authInfo.extra?.["authorizationDetails"] ?? authInfo.extra?.["authorization_details"];
+	return Array.isArray(details) ? details : void 0;
+}
+function delegationOf(authInfo) {
+	return compact({
+		scopes: authInfo.scopes,
+		authorizationDetails: authorizationDetailsOf(authInfo)
+	});
+}
+function hasScope(authInfo, scope) {
+	return (authInfo.scopes ?? []).includes(scope);
+}
+function resourceMetadataOf(authInfo) {
+	if (authInfo.resourceMetadataUrl !== void 0) return authInfo.resourceMetadataUrl;
+	const resource = authInfo.resource;
+	return resource?.protocol === "https:" || resource?.protocol === "http:" ? protectedResourceMetadataUrl(resource) : void 0;
+}
+function sameResource(expected, actual) {
+	if (actual === void 0) return false;
+	try {
+		return new URL(String(expected)).href === new URL(String(actual)).href;
+	} catch {
+		return false;
+	}
+}
+function acceptsUrlElicitation(context, fallback) {
+	const fromEnvelope = context.mcpReq?.envelope?.[CLIENT_CAPABILITIES];
+	const capabilities = isRecord$1(fromEnvelope) ? fromEnvelope : fallback?.();
+	if (!isRecord$1(capabilities) || !isRecord$1(capabilities["elicitation"])) return false;
+	return isRecord$1(capabilities["elicitation"]["url"]);
+}
+function withParams(at, params) {
+	let url;
+	try {
+		url = new URL(at);
+	} catch {
+		return;
+	}
+	for (const [name, value] of Object.entries(params)) if (value !== void 0) url.searchParams.set(name, value);
+	return url.href;
+}
+function urlElicitation(key, message, url, requestState) {
+	return compact({
+		resultType: "input_required",
+		inputRequests: { [key]: {
+			method: "elicitation/create",
+			params: {
+				mode: "url",
+				message,
+				url
+			}
+		} },
+		requestState
+	});
+}
+function resourceRef(permission, data) {
+	if (isRecord$1(data)) {
+		const id = data["id"];
+		if (typeof id === "string" || typeof id === "number") return {
+			type: permission.resource,
+			id: String(id)
+		};
+	}
+	return { type: permission.resource };
+}
+function deniedRefusal(decision, permission, data) {
+	const alternatives = decision.alternatives.map((leaf) => leaf.key);
+	const resource = resourceRef(permission, data);
+	return {
+		text: `Denied: ${resource.id === void 0 ? permission.key : `${permission.key} on ${resource.id}`}.${alternatives.length === 0 ? "" : ` You may: ${alternatives.join(", ")}.`}`,
+		structured: {
+			outcome: "denied",
+			permission: permission.key,
+			resource,
+			denials: wireDenials(decision.denials),
+			alternatives,
+			detail: describe(decision).detail
+		}
+	};
+}
+function approvalRefusal(decision, permission, data) {
+	return {
+		text: describe(decision).detail,
+		structured: {
+			outcome: "approval-required",
+			permission: permission.key,
+			resource: resourceRef(permission, data),
+			token: decision.token
+		}
+	};
+}
+function plainRefusal(permission, text, extra) {
+	return {
+		text,
+		structured: {
+			outcome: "denied",
+			permission: permission.key,
+			resource: { type: permission.resource },
+			alternatives: [],
+			...extra
+		}
+	};
+}
+function toolRefusal(refusal) {
+	if (refusal.inputRequired !== void 0) return refusal.inputRequired;
+	return {
+		isError: true,
+		content: [{
+			type: "text",
+			text: refusal.text
+		}],
+		structuredContent: refusal.structured
+	};
+}
+function requirePermission(kind, name, config) {
+	const permission = isRecord$1(config) ? config["permission"] : void 0;
+	if (!isRecord$1(permission) || typeof permission["key"] !== "string") throw new TypeError(`permdock/mcp: ${kind} ${name} has no permission; every guarded registration needs one.`);
+	return permission;
+}
+function sessionKey(context) {
+	return context.sessionId ?? "";
+}
+function throwRefusal(refusal) {
+	if (refusal.inputRequired !== void 0) return refusal.inputRequired;
+	throw new Error(refusal.text);
+}
+function challengeFor(permission, own) {
+	return async (context) => {
+		const first = await own?.(context);
+		if (first !== void 0) return first;
+		const authInfo = context.authInfo;
+		if (authInfo === void 0 || hasScope(authInfo, permission.scope)) return;
+		return { scopes: [permission.scope] };
+	};
+}
+function guardUpdates(registered, wrap, rename, currentName) {
+	const update = registered.update.bind(registered);
+	registered.update = (updates) => {
+		const next = { ...updates };
+		if (typeof updates["callback"] === "function") next["callback"] = wrap(updates["callback"]);
+		if (rename !== void 0 && currentName !== void 0) {
+			const to = updates["name"];
+			if (typeof to === "string" || to === null) rename(currentName(), to);
+		}
+		update(next);
+	};
+}
+function createPermDock(policy, options) {
+	const instanceFor = async (authInfo) => {
+		const material = authInfo ?? {};
+		let user = null;
+		try {
+			user = await options.subject(material);
+		} catch {
+			user = null;
+		}
+		let tenant;
+		try {
+			tenant = typeof options.tenant === "function" ? await options.tenant(material) : options.tenant;
+		} catch {
+			tenant = void 0;
+		}
+		const clientId = authInfo?.clientId;
+		const built = await createPermDock$1(policy, user, compact({
+			tenant,
+			actor: typeof clientId === "string" && clientId !== "" ? {
+				id: clientId,
+				kind: "mcp-client"
+			} : void 0,
+			delegation: authInfo === void 0 ? void 0 : delegationOf(authInfo),
+			memberships: options.memberships,
+			relations: options.relations,
+			entitlements: options.entitlements,
+			customRoles: options.customRoles,
+			policies: options.policies,
+			sink: options.sink,
+			limits: options.limits
+		}));
+		return options.otel === void 0 ? built : options.otel(built);
+	};
+	const forThisServer = (authInfo) => options.resource === void 0 || sameResource(options.resource, authInfo.resource);
+	const reachable = (authInfo, permission) => authInfo === void 0 ? options.requireAuthInfo !== true : forThisServer(authInfo) && hasScope(authInfo, permission.scope);
+	const approvalInput = async (decision, handlerContext, context, capabilities) => {
+		const at = options.approval?.at;
+		if (at === void 0 || !acceptsUrlElicitation(context, capabilities)) return;
+		const url = withParams(at, { token: decision.token });
+		if (url === void 0) return;
+		const requestState = options.requestState === void 0 ? decision.token : await options.requestState.mint(decision.token, handlerContext);
+		return urlElicitation("approval", options.approval?.hint ?? describe(decision).detail, url, requestState);
+	};
+	const stepUpRefusal = (decision, permission, data, context, capabilities) => {
+		const base = deniedRefusal(decision, permission, data);
+		const { acrValues, maxAge } = stepUpOf(decision);
+		const at = options.stepUp?.at;
+		const url = at === void 0 || !acceptsUrlElicitation(context, capabilities) ? void 0 : withParams(at, {
+			acr_values: acrValues?.join(" "),
+			max_age: maxAge === void 0 ? void 0 : String(maxAge)
+		});
+		return compact({
+			text: base.text,
+			structured: compact({
+				...base.structured,
+				error: "insufficient_user_authentication",
+				acr_values: acrValues?.join(" "),
+				max_age: maxAge,
+				www_authenticate: bearerChallenge(compact({
+					error: "insufficient_user_authentication",
+					acrValues,
+					maxAge
+				}))
+			}),
+			inputRequired: url === void 0 ? void 0 : urlElicitation("step_up", `Sign in again to use ${permission.key}.`, url, void 0)
+		});
+	};
+	const check = async (permission, load, context, handlerContext, capabilities, completion) => {
+		const authInfo = context.http?.authInfo;
+		if (authInfo === void 0 && options.requireAuthInfo === true) return {
+			ok: false,
+			refusal: plainRefusal(permission, "Denied: no verified credentials.", { error: "invalid_token" })
+		};
+		if (authInfo !== void 0 && !forThisServer(authInfo)) return {
+			ok: false,
+			refusal: plainRefusal(permission, "Denied: the token was not issued for this server.", { error: "invalid_token" })
+		};
+		if (authInfo !== void 0 && !hasScope(authInfo, permission.scope)) {
+			const resourceMetadata = resourceMetadataOf(authInfo);
+			return {
+				ok: false,
+				refusal: plainRefusal(permission, `Denied: ${permission.key} needs the ${permission.scope} scope.`, compact({
+					error: "insufficient_scope",
+					scope: permission.scope,
+					resource_metadata: resourceMetadata,
+					www_authenticate: bearerChallenge(compact({
+						error: "insufficient_scope",
+						scopes: [permission.scope],
+						resourceMetadata
+					}))
+				}))
+			};
+		}
+		let data;
+		if (load !== void 0) {
+			try {
+				data = await load();
+			} catch {
+				return {
+					ok: false,
+					refusal: plainRefusal(permission, `Denied: ${permission.key} failed closed.`, { denials: [{
+						role: null,
+						reason: "validation"
+					}] })
+				};
+			}
+			if (data === null || data === void 0) return {
+				ok: false,
+				refusal: plainRefusal(permission, `Denied: ${permission.key} found nothing to decide on.`, { denials: [{
+					role: null,
+					reason: "validation"
+				}] })
+			};
+		}
+		try {
+			const permdock = await instanceFor(authInfo);
+			const raw = permdock.decide(permission, data, {
+				source: completion === void 0 ? "adapter" : "simulate",
+				adapter: "mcp",
+				boundary: "mcp-args"
+			});
+			if (completion !== void 0) {
+				if (stillAllowed(raw, completion.approved)) return { ok: true };
+				return {
+					ok: false,
+					refusal: raw.outcome === "denied" ? deniedRefusal(raw, permission, data) : plainRefusal(permission, `Denied: ${permission.key} was revoked before the call completed.`, {})
+				};
+			}
+			const decision = await resumeDecision({
+				decision: raw,
+				permission,
+				subject: permdock.subject,
+				store: options.store,
+				resource: resourceRef(permission, data),
+				adapter: "mcp",
+				token: approvalTokenOf(context) ?? await storedApprovalToken(options.store, raw, false)
+			});
+			switch (decision.outcome) {
+				case "granted": return raw.outcome === "approval-required" ? {
+					ok: true,
+					approved: raw.token
+				} : { ok: true };
+				case "denied": return {
+					ok: false,
+					refusal: decision.denials.some((denial) => denial.reason === "insufficient-user-authentication") ? stepUpRefusal(decision, permission, data, context, capabilities) : deniedRefusal(decision, permission, data)
+				};
+				case "approval-required": return {
+					ok: false,
+					refusal: compact({
+						...approvalRefusal(decision, permission, data),
+						inputRequired: await approvalInput(decision, handlerContext, context, capabilities)
+					})
+				};
+				default: return decision;
+			}
+		} catch {
+			return {
+				ok: false,
+				refusal: plainRefusal(permission, `Denied: ${permission.key} failed closed.`, {})
+			};
+		}
+	};
+	const visible = async (context, permissionOf, keys) => {
+		const authInfo = context.http?.authInfo;
+		const shown = /* @__PURE__ */ new Set();
+		const guarded = [];
+		for (const key of keys) {
+			const permission = permissionOf(key);
+			if (permission === void 0) shown.add(key);
+			else if (reachable(authInfo, permission)) guarded.push({
+				key,
+				permission
+			});
+		}
+		if (guarded.length === 0) return shown;
+		let permdock;
+		try {
+			permdock = await instanceFor(authInfo);
+		} catch {
+			return shown;
+		}
+		for (const entry of guarded) if (mayUse(permdock, entry.permission)) shown.add(entry.key);
+		return shown;
+	};
+	const guard = (permission, load, handler, dataArgs, onRefusal, extra = {}) => async (...params) => {
+		const raw = params.at(-1);
+		const context = contextOf(raw);
+		const loader = load === void 0 ? void 0 : () => load(...dataArgs(params));
+		const checked = await check(permission, loader, context, raw, extra.capabilities);
+		let result;
+		if (checked.ok) {
+			result = await handler(...params);
+			if (extra.longRunning === true) {
+				const again = await check(permission, loader, context, raw, extra.capabilities, { approved: checked.approved });
+				if (!again.ok) result = onRefusal(again.refusal);
+			}
+		} else result = onRefusal(checked.refusal);
+		await extra.after?.(context);
+		return result;
+	};
+	const protectServer = (server) => {
+		const tools = /* @__PURE__ */ new Map();
+		const prompts = /* @__PURE__ */ new Map();
+		const resources = /* @__PURE__ */ new Map();
+		const templates = [];
+		const lastListed = boundedMap(SESSIONS_PER_SERVER);
+		const toolPermission = (name) => tools.get(name);
+		const promptPermission = (name) => prompts.get(name);
+		const resourcePermission = (uri) => {
+			const direct = resources.get(uri);
+			if (direct !== void 0) return direct;
+			return templates.find((entry) => entry.template.uriTemplate.match(uri) !== null)?.permission;
+		};
+		const templatePermission = (uriTemplate) => templates.find((entry) => entry.template.uriTemplate.toString() === uriTemplate)?.permission;
+		const listFilter = (field, keyOf, permissionOf, remember) => async (result, rawContext) => {
+			if (!isRecord$1(result) || !Array.isArray(result[field])) return result;
+			const context = contextOf(rawContext);
+			const entries = result[field];
+			const shown = await visible(context, permissionOf, entries.map(keyOf));
+			const kept = entries.filter((entry) => shown.has(keyOf(entry)));
+			if (remember) lastListed.set(sessionKey(context), [...shown].toSorted().join(","));
+			return {
+				...result,
+				[field]: kept,
+				cacheScope: "private"
+			};
+		};
+		const filters = {
+			"tools/list": listFilter("tools", (entry) => entry.name, toolPermission, true),
+			"prompts/list": listFilter("prompts", (entry) => entry.name, promptPermission, false),
+			"resources/list": listFilter("resources", (entry) => entry.uri, resourcePermission, false),
+			"resources/templates/list": listFilter("resourceTemplates", (entry) => entry.uriTemplate, templatePermission, false)
+		};
+		const inner = server.server;
+		const capabilities = () => inner.getClientCapabilities?.();
+		const set = inner.setRequestHandler.bind(inner);
+		inner.setRequestHandler = (method, ...rest) => {
+			const filter = Object.hasOwn(filters, method) ? filters[method] : void 0;
+			const [handler] = rest;
+			if (filter !== void 0 && rest.length === 1 && typeof handler === "function") {
+				set(method, async (request, context) => filter(await handler(request, context), context));
+				return;
+			}
+			set(method, ...rest);
+		};
+		for (const method of Object.keys(filters)) {
+			const existing = inner._getRequestHandler?.(method);
+			if (existing !== void 0) {
+				inner.removeRequestHandler(method);
+				inner.setRequestHandler(method, (request, context) => existing(request, context));
+			}
+		}
+		const announce = async (context) => {
+			const key = sessionKey(context);
+			const before = lastListed.get(key);
+			if (before === void 0) return;
+			const after = [...await visible(context, toolPermission, [...tools.keys()])].toSorted().join(",");
+			if (after === before) return;
+			lastListed.set(key, after);
+			try {
+				await (context.mcpReq?.notify?.({ method: "notifications/tools/list_changed" }) ?? inner.sendToolListChanged?.());
+			} catch {}
+		};
+		const guardTool = (permission, load, handler, longRunning) => guard(permission, load, handler, (params) => params.length >= 2 ? [params[0]] : [void 0], toolRefusal, {
+			after: announce,
+			longRunning,
+			capabilities
+		});
+		const originalTool = server.registerTool.bind(server);
+		const registerTool = (name, config, handler) => {
+			const permission = requirePermission("tool", name, config);
+			const { permission: _permission, data, scopeChallenge, longRunning: rawLongRunning, ...passthrough } = config;
+			const load = data;
+			const longRunning = rawLongRunning === true;
+			const registered = originalTool(name, {
+				...passthrough,
+				annotations: {
+					...annotationsFor(permission),
+					...passthrough["annotations"]
+				},
+				scopeChallenge: challengeFor(permission, scopeChallenge)
+			}, guardTool(permission, load, handler, longRunning));
+			tools.set(name, permission);
+			let current = name;
+			guardUpdates(registered, (callback) => guardTool(permission, load, callback, longRunning), (from, to) => {
+				tools.delete(from);
+				if (to !== null) {
+					tools.set(to, permission);
+					current = to;
+				}
+			}, () => current);
+			return registered;
+		};
+		const originalPrompt = server.registerPrompt.bind(server);
+		const registerPrompt = (name, config, handler) => {
+			const permission = requirePermission("prompt", name, config);
+			const { permission: _permission, data, scopeChallenge, ...passthrough } = config;
+			const load = data;
+			const wrap = (callback) => guard(permission, load, callback, (params) => params.length >= 2 ? [params[0]] : [void 0], throwRefusal, { capabilities });
+			const registered = originalPrompt(name, {
+				...passthrough,
+				scopeChallenge: challengeFor(permission, scopeChallenge)
+			}, wrap(handler));
+			prompts.set(name, permission);
+			guardUpdates(registered, wrap);
+			return registered;
+		};
+		const originalResource = server.registerResource.bind(server);
+		const registerResource = (name, uriOrTemplate, config, read) => {
+			const permission = requirePermission("resource", name, config);
+			const { permission: _permission, data, scopeChallenge, ...passthrough } = config;
+			const load = data;
+			const wrap = (callback) => guard(permission, load, callback, (params) => params.slice(0, -1), throwRefusal, { capabilities });
+			const registered = originalResource(name, uriOrTemplate, {
+				...passthrough,
+				scopeChallenge: challengeFor(permission, scopeChallenge)
+			}, wrap(read));
+			if (typeof uriOrTemplate === "string") resources.set(uriOrTemplate, permission);
+			else templates.push({
+				template: uriOrTemplate,
+				permission
+			});
+			guardUpdates(registered, wrap);
+			return registered;
+		};
+		const guarded = server;
+		guarded["registerTool"] = registerTool;
+		guarded["registerPrompt"] = registerPrompt;
+		guarded["registerResource"] = registerResource;
+		return server;
+	};
+	return { protectServer };
+}
+//#endregion
+//#region src/mcp/subject.ts
+function isRecord(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+/**
+* Maps the `AuthInfo` the MCP SDK's bearer verification produced to a
+* `Subject`: the principal from the verified claims in `extra`, the client
+* as an `mcp-client` actor, the granted scopes as the delegation. Never
+* verifies and never throws; anything unusable is the anonymous subject.
+*/
+function subjectFromMcp(authInfo, options = {}) {
+	try {
+		if (authInfo === void 0 || !isRecord(authInfo.extra)) return anonymousSubject();
+		const claims = compact({
+			...authInfo.extra,
+			authorization_details: authInfo.extra["authorizationDetails"] ?? authInfo.extra["authorization_details"],
+			scope: authInfo.scopes?.join(" "),
+			client_id: authInfo.clientId,
+			exp: authInfo.expiresAt
+		});
+		const mapped = mapClaimsToSubject(claims, options);
+		if (mapped.invalidClaims || mapped.invalidChain || mapped.subject.principal === null) return anonymousSubject();
+		const clientId = authInfo.clientId;
+		return freezeDeep(compact({
+			...mapped.subject,
+			actor: typeof clientId === "string" && clientId !== "" ? {
+				id: clientId,
+				kind: "mcp-client"
+			} : mapped.subject.actor
+		}));
+	} catch {
+		return anonymousSubject();
+	}
+}
+//#endregion
+export { APPROVAL_META_KEY, createPermDock, subjectFromMcp };