permdock 0.13.0 → 0.15.0

package/dist/{fixtures-A1_sp_tR.js → fixtures-Bm4_K1ke.js}

@@ -5,12 +5,14 @@ import { a as loadModule, s as pickNamed } from "./load-DjSU5KXO.js";
 import { existsSync } from "node:fs";
 import { resolve } from "node:path";
 //#region src/cli/fixtures.ts
-function asFixtures(value) {
+function asFixtures(value, followed = false) {
 	const list = Array.isArray(value) ? value : isRecord(value) && Array.isArray(value["fixtures"]) ? value["fixtures"] : void 0;
 	if (list === void 0) throw configError("PermDock CLI: fixtures must be an array or { fixtures }");
 	return list.map((item, index) => {
 		if (!isRecord(item) || !isRecord(item["subject"]) || item["row"] === void 0) throw configError(`PermDock CLI: fixture ${index} needs subject and row`);
-		if (typeof item["action"] !== "string") throw new TypeError(`PermDock CLI: fixture ${index} needs action`);
+		if (followed && item["table"] !== void 0) {
+			if (typeof item["table"] !== "string" || item["table"].length === 0 || item["action"] !== void 0 || item["expected"] !== "granted" && item["expected"] !== "denied") throw configError(`PermDock CLI: fixture ${index} needs table and expected (granted or denied), without action`);
+		} else if (typeof item["action"] !== "string") throw new TypeError(`PermDock CLI: fixture ${index} needs action`);
 		if (typeof item["subject"]["id"] !== "string") throw new TypeError(`PermDock CLI: fixture ${index} subject needs id`);
 		const memberships = item["subject"]["memberships"];
 		if (memberships !== void 0 && !Array.isArray(memberships)) throw configError(`PermDock CLI: fixture ${index} subject.memberships must be an array`);
@@ -26,23 +28,19 @@ function asCustomRoles(value) {
 	if (!Array.isArray(value["customRoles"])) throw new TypeError("PermDock CLI: fixtures customRoles must be an array");
 	return value["customRoles"];
 }
-/**
-* A `.json` file or a module exporting `fixtures` (or default) and optionally
-* `customRoles`.
-*/
-async function loadFixtures(cwd, path) {
+async function loadFixtures(cwd, path, followed = false) {
 	const abs = resolve(cwd, path);
 	if (!existsSync(abs)) throw configError(`PermDock CLI: fixtures not found: ${path}`);
 	if (abs.endsWith(".json")) {
 		const parsed = readJsonFile(abs);
 		return {
-			fixtures: asFixtures(parsed),
+			fixtures: asFixtures(parsed, followed),
 			customRoles: asCustomRoles(parsed)
 		};
 	}
 	const mod = await loadModule(abs);
 	return {
-		fixtures: asFixtures(pickNamed(mod, ["fixtures", "default"])),
+		fixtures: asFixtures(pickNamed(mod, ["fixtures", "default"]), followed),
 		customRoles: asCustomRoles(mod)
 	};
 }

package/dist/{import-PP7uH8rC.js → import-DK_J8tVE.js}

@@ -4,7 +4,7 @@ import { i as readJsonFile } from "./files-BSjrtIHw.js";
 import { t as applyFiles } from "./files-B3AA05f1.js";
 import { n as httpRequest } from "./http-DOL33cO0.js";
 import { i as schemaExpression, t as emitPermissionsModule } from "./generate-CezbCaTI.js";
-import { t as validateOpenapi } from "./schema-CeQZY6bO.js";
+import { t as validateOpenapi } from "./schema-BDGEVO4g.js";
 import { existsSync, readFileSync } from "node:fs";
 import { resolve } from "node:path";
 //#region ../../node_modules/.pnpm/yaml@2.9.1/node_modules/yaml/browser/dist/nodes/identity.js

package/dist/{init-n1gkKHvc.js → init-Buibrl9h.js}

@@ -48,7 +48,7 @@ const init = defineLeaf({
 		...forceFlag
 	},
 	async run(ctx, { flags }) {
-		const [{ runInit }, { packageManagerOf }] = await Promise.all([import("./init-BuUt4bLJ.js"), import("./peer-C9LvBCcb.js")]);
+		const [{ runInit }, { packageManagerOf }] = await Promise.all([import("./init-jLSyPMM7.js"), import("./peer-C9LvBCcb.js")]);
 		const agent = await packageManagerOf(ctx.cwd);
 		const selection = {
 			archetype: flags.archetype,
@@ -79,7 +79,7 @@ const presetDecode = defineLeaf({
 	positionals: presetCode,
 	flags: {},
 	async run(_ctx, { args }) {
-		const { runPreset } = await import("./init-BuUt4bLJ.js");
+		const { runPreset } = await import("./init-jLSyPMM7.js");
 		return runPreset("decode", args["code"] ?? "");
 	}
 });
@@ -87,7 +87,7 @@ const presetUrl = defineLeaf({
 	positionals: presetCode,
 	flags: {},
 	async run(_ctx, { args }) {
-		const { runPreset } = await import("./init-BuUt4bLJ.js");
+		const { runPreset } = await import("./init-jLSyPMM7.js");
 		return runPreset("url", args["code"] ?? "");
 	}
 });

package/dist/{init-BuUt4bLJ.js → init-jLSyPMM7.js}

@@ -1,6 +1,6 @@
 import { n as CliError } from "./errors-Vpu6rKHl.js";
 import { a as decodePreset, g as resolvePreset, i as presetFlags, n as generatePreset, o as encodePreset } from "./preset-BjLzeFpp.js";
-import { a as nonEmptyOr } from "./output-DpCUAST3.js";
+import { a as nonEmptyOr } from "./output-BVZpQDad.js";
 import { t as addLine } from "./peer-Q0fuZ6hx.js";
 import { t as applyFiles } from "./files-B3AA05f1.js";
 import { existsSync } from "node:fs";

package/dist/{kernel-qv4cr9w8.js → kernel-BD8QuMnv.js}

@@ -228,6 +228,11 @@ function createAgentKernel(policy, given) {
 	const boundary = options.boundary ?? "tool-args";
 	const tools = options.tools ?? {};
 	const run = async (binding, args, context, how) => {
+		const onError = (error) => {
+			try {
+				how.decideOptions.onError?.(error);
+			} catch {}
+		};
 		let permdock;
 		try {
 			permdock = await instance(context);
@@ -252,7 +257,8 @@ function createAgentKernel(policy, given) {
 			if (binding.data !== void 0) {
 				try {
 					data = await binding.data(args);
-				} catch {
+				} catch (error) {
+					onError(error);
 					return {
 						ok: false,
 						failure: "load-failed",
@@ -291,7 +297,8 @@ function createAgentKernel(policy, given) {
 				raw,
 				decision
 			};
-		} catch {
+		} catch (error) {
+			onError(error);
 			return compact({
 				ok: false,
 				failure: "failed",

package/dist/{login-YsrgkAQo.js → login-CB55O4Gv.js}

@@ -3,7 +3,7 @@ import { n as CliError } from "./errors-Vpu6rKHl.js";
 import { i as postForm, r as parseToken, s as runDeviceFlow } from "./device-BwbJNmb2.js";
 import { i as writeCredentials, n as deleteCredentials, r as readCredentials, t as credentialsPath } from "./storage-C2bWdvJH.js";
 import { n as randomToken, t as pkce } from "./pkce-CnmmYqUZ.js";
-import { a as nonEmptyOr } from "./output-DpCUAST3.js";
+import { a as nonEmptyOr } from "./output-BVZpQDad.js";
 import { n as httpRequest } from "./http-DOL33cO0.js";
 import { c as READ_SCOPES, d as issuerMetadata, i as credentialsInsideRepository, l as cloudUrl, n as cliRuntime, r as credentialStorage, s as CLI_CLIENT_ID, t as CREDENTIAL_SERVICE } from "./auth--yPyZNgr.js";
 import { spawn } from "node:child_process";

package/dist/{login-DyQNWJok.js → login-VVpkkund.js}

@@ -27,7 +27,7 @@ const login = defineLeaf({
 		}
 	},
 	async run(ctx, { flags }) {
-		const { runLogin } = await import("./login-YsrgkAQo.js");
+		const { runLogin } = await import("./login-CB55O4Gv.js");
 		return runLogin({
 			cwd: ctx.cwd,
 			url: given(flags.url),
@@ -43,7 +43,7 @@ const login = defineLeaf({
 const logout = defineLeaf({
 	flags: { ...urlFlag },
 	async run(ctx, { flags }) {
-		const { runLogout } = await import("./login-YsrgkAQo.js");
+		const { runLogout } = await import("./login-CB55O4Gv.js");
 		return runLogout({
 			url: given(flags.url),
 			json: ctx.json,
@@ -55,7 +55,7 @@ const logout = defineLeaf({
 const whoami = defineLeaf({
 	flags: { ...urlFlag },
 	async run(ctx, { flags }) {
-		const { runWhoami } = await import("./login-YsrgkAQo.js");
+		const { runWhoami } = await import("./login-CB55O4Gv.js");
 		return runWhoami({
 			url: given(flags.url),
 			json: ctx.json,

package/dist/{manifest-Cl6yHiVK.js → manifest-CbEyvPN2.js}

@@ -30,20 +30,20 @@ const SECTIONS = [
 				docs: "init",
 				effects: ["files"],
 				config: false,
-				load: async () => (await import("./init-n1gkKHvc.js")).init
+				load: async () => (await import("./init-Buibrl9h.js")).init
 			}),
 			group("preset", "Decode a preset code, or print its permdock.com/create link", "preset", [leaf("decode", "Print what a preset code holds", {
 				examples: ["permdock preset decode p1AQIDBAc"],
 				docs: "preset",
 				effects: [],
 				config: false,
-				load: async () => (await import("./init-n1gkKHvc.js")).presetDecode
+				load: async () => (await import("./init-Buibrl9h.js")).presetDecode
 			}), leaf("url", "Print the permdock.com/create link that opens a code", {
 				examples: ["permdock preset url p1AQIDBAc"],
 				docs: "preset",
 				effects: [],
 				config: false,
-				load: async () => (await import("./init-n1gkKHvc.js")).presetUrl
+				load: async () => (await import("./init-Buibrl9h.js")).presetUrl
 			})]),
 			group("skills", "Install, update or list the PermDock Agent Skills", "skills", [
 				leaf("install", "Copy the Agent Skills into the agent folders", {
@@ -55,21 +55,21 @@ const SECTIONS = [
 					docs: "skills",
 					effects: ["files"],
 					config: false,
-					load: async () => (await import("./skills-CfkYP7GG.js")).install
+					load: async () => (await import("./skills-BIsm1n26.js")).install
 				}),
 				leaf("update", "Replace installed skills with this version's", {
 					examples: ["permdock skills update"],
 					docs: "skills",
 					effects: ["files"],
 					config: false,
-					load: async () => (await import("./skills-CfkYP7GG.js")).update
+					load: async () => (await import("./skills-BIsm1n26.js")).update
 				}),
 				leaf("list", "List the skills and where each is installed", {
 					examples: ["permdock skills list"],
 					docs: "skills",
 					effects: [],
 					config: false,
-					load: async () => (await import("./skills-CfkYP7GG.js")).list
+					load: async () => (await import("./skills-BIsm1n26.js")).list
 				})
 			]),
 			leaf("doctor", "Check a PermDock installation and print a fix for each finding", {
@@ -82,7 +82,7 @@ const SECTIONS = [
 				effects: ["files"],
 				config: true,
 				findings: true,
-				load: async () => (await import("./doctor-Dea6IqRw.js")).doctor
+				load: async () => (await import("./doctor-gIO9WTYo.js")).doctor
 			}),
 			leaf("completion", "Print the shell completion script for bash, zsh or fish", {
 				examples: ["permdock completion zsh > ~/.zfunc/_permdock", "eval \"$(permdock completion bash)\""],
@@ -90,7 +90,7 @@ const SECTIONS = [
 				effects: [],
 				config: false,
 				shellOutput: true,
-				load: async () => (await import("./completion-Cq4fbT2S.js")).completion
+				load: async () => (await import("./completion-DCza8aQY.js")).completion
 			})
 		]
 	},
@@ -106,7 +106,7 @@ const SECTIONS = [
 				docs: "collect",
 				effects: ["files"],
 				config: true,
-				load: async () => (await import("./collect-D9Tt0Bcx.js")).collect
+				load: async () => (await import("./collect-DnXL4B8c.js")).collect
 			}),
 			leaf("catalog", "Export the catalog as catalog JSON, JSON Schema or Markdown", {
 				examples: ["permdock catalog --out permissions.catalog.json", "permdock catalog --kind markdown"],
@@ -132,14 +132,14 @@ const SECTIONS = [
 				effects: [],
 				config: true,
 				findings: true,
-				load: async () => (await import("./usage-BfzSfOpD.js")).usage
+				load: async () => (await import("./usage-DBNrpwoT.js")).usage
 			}),
 			leaf("diff", "Compare two policies or catalogs; exit 1 on a breaking change", {
 				examples: ["permdock diff main.catalog.json permissions.catalog.json", "permdock diff ./old-policy.ts ./src/policy.ts --impact"],
 				docs: "diff",
 				effects: [],
 				config: true,
-				load: async () => (await import("./diff-BwR1JdP2.js")).diff
+				load: async () => (await import("./diff-CxtbOi2l.js")).diff
 			}),
 			leaf("config", "Check permdock.config.ts for unknown keys, or print the effective config", {
 				examples: ["permdock config", "permdock config --print"],
@@ -147,7 +147,7 @@ const SECTIONS = [
 				effects: [],
 				config: true,
 				findings: true,
-				load: async () => (await import("./config-0xxCmoD8.js")).config
+				load: async () => (await import("./config-BAM3a3z8.js")).config
 			})
 		]
 	},
@@ -164,14 +164,14 @@ const SECTIONS = [
 						"network"
 					],
 					config: true,
-					load: async () => (await import("./rls-C8nxX0RV.js")).generate
+					load: async () => (await import("./rls-yK2nZUcm.js")).generate
 				}),
 				leaf("import", "Turn existing RLS policies into a generated definition", {
 					examples: ["permdock rls import --sql schema.sql --out src/permissions.generated.ts", "permdock rls import --db-url-stdin --out src/permissions.generated.ts"],
 					docs: "rls",
 					effects: ["files", "database:read"],
 					config: true,
-					load: async () => (await import("./rls-C8nxX0RV.js")).importPolicies
+					load: async () => (await import("./rls-yK2nZUcm.js")).importPolicies
 				}),
 				leaf("verify", "Run the fixtures against the policies, or compare a live database", {
 					examples: [
@@ -183,21 +183,21 @@ const SECTIONS = [
 					effects: ["files", "database:read"],
 					config: true,
 					findings: true,
-					load: async () => (await import("./rls-C8nxX0RV.js")).verify
+					load: async () => (await import("./rls-yK2nZUcm.js")).verify
 				}),
 				leaf("migrate", "Rewrite hand-written policies onto the generated helpers", {
 					examples: ["permdock rls migrate --sql supabase/migrations --dry-run", "permdock rls migrate --sql supabase/migrations"],
 					docs: "rls",
 					effects: ["rewrite", "files"],
 					config: true,
-					load: async () => (await import("./rls-C8nxX0RV.js")).migrate
+					load: async () => (await import("./rls-yK2nZUcm.js")).migrate
 				}),
 				leaf("explain", "Show the tables, membership sources and triggers the SQL binds to", {
 					examples: ["permdock rls explain", "permdock rls explain --db-url-stdin --json"],
 					docs: "rls",
 					effects: ["database:read"],
 					config: true,
-					load: async () => (await import("./rls-C8nxX0RV.js")).explain
+					load: async () => (await import("./rls-yK2nZUcm.js")).explain
 				})
 			]),
 			group("supabase", "Generate the Supabase Custom Access Token Hook, or inspect its manifest", "supabase", [group("hook", "The Custom Access Token Hook", "supabase", [leaf("generate", "Compile the membership sources into the hook migration", {
@@ -205,26 +205,26 @@ const SECTIONS = [
 				docs: "supabase",
 				effects: ["files", "database:read"],
 				config: true,
-				load: async () => (await import("./supabase-CBEK6KEo.js")).hookGenerate
+				load: async () => (await import("./supabase-DYWnT800.js")).hookGenerate
 			})]), leaf("inspect", "Print or write the hook and helper manifest", {
 				examples: ["permdock supabase inspect", "permdock supabase inspect --out"],
 				docs: "supabase",
 				effects: ["files"],
 				config: true,
-				load: async () => (await import("./supabase-CBEK6KEo.js")).inspect
+				load: async () => (await import("./supabase-DYWnT800.js")).inspect
 			})]),
 			group("powersync", "Generate PowerSync Sync Streams from the policy, or verify them", "powersync", [leaf("generate", "Compile the read grants into sync-config.yaml", {
 				examples: ["permdock powersync generate", "permdock powersync generate --check"],
 				docs: "powersync",
 				effects: ["files"],
 				config: true,
-				load: async () => (await import("./powersync-Bm3ZjHwD.js")).generate
+				load: async () => (await import("./powersync-CFWILHjb.js")).generate
 			}), leaf("verify", "Fail on stale streams or a stream that syncs a denied row", {
 				examples: ["permdock powersync verify", "permdock powersync verify --db-url-stdin"],
 				docs: "powersync",
 				effects: ["database:read"],
 				config: true,
-				load: async () => (await import("./powersync-Bm3ZjHwD.js")).verify
+				load: async () => (await import("./powersync-CFWILHjb.js")).verify
 			})]),
 			group("scim", "Generate the Postgres tables postgresDirectoryStore keeps a SCIM directory in", "scim", [leaf("generate", "Write the tenant-keyed users, groups and members tables", {
 				examples: [
@@ -247,13 +247,13 @@ const SECTIONS = [
 				docs: "openapi",
 				effects: ["files"],
 				config: true,
-				load: async () => (await import("./openapi-BFyBIe9J.js")).emit
+				load: async () => (await import("./openapi-eHZ5hwUJ.js")).emit
 			}), leaf("import", "Turn an OpenAPI document into a generated definition", {
 				examples: ["permdock openapi import --doc openapi.yaml --out src/permissions.generated.ts"],
 				docs: "openapi",
 				effects: ["files", "network"],
 				config: false,
-				load: async () => (await import("./openapi-BFyBIe9J.js")).importDocument
+				load: async () => (await import("./openapi-eHZ5hwUJ.js")).importDocument
 			})]),
 			group("arazzo", "Check Arazzo workflows against the permissions", "arazzo", [leaf("check", "Resolve every Arazzo step to x-permdock-permissions", {
 				examples: ["permdock arazzo check --doc arazzo.json --openapi openapi.json"],
@@ -261,7 +261,7 @@ const SECTIONS = [
 				effects: [],
 				config: true,
 				findings: true,
-				load: async () => (await import("./arazzo-CBBIhC40.js")).check
+				load: async () => (await import("./arazzo-CL8CZnpL.js")).check
 			})]),
 			leaf("scan", "List authorization checks written without PermDock, to adopt it in an existing app", {
 				examples: ["permdock scan", "permdock scan --src app,lib --pattern isBeta"],
@@ -269,7 +269,7 @@ const SECTIONS = [
 				effects: [],
 				config: true,
 				findings: true,
-				load: async () => (await import("./scan-COIQvTMg.js")).scan
+				load: async () => (await import("./scan-CzdMtHnq.js")).scan
 			}),
 			group("casl", "Import CASL rules into a generated module", "casl", [leaf("import", "Turn CASL rules per role into a permissions and policy module", {
 				examples: ["permdock casl import --rules rules.json --out src/permissions.generated.ts"],
@@ -283,7 +283,7 @@ const SECTIONS = [
 				docs: "casbin",
 				effects: ["files"],
 				config: false,
-				load: async () => (await import("./casbin-C8r5trwy.js")).casbinImport
+				load: async () => (await import("./casbin-DRFwgVIP.js")).casbinImport
 			})])
 		]
 	},
@@ -295,34 +295,34 @@ const SECTIONS = [
 				docs: "login",
 				effects: ["network", "files"],
 				config: false,
-				load: async () => (await import("./login-DyQNWJok.js")).login
+				load: async () => (await import("./login-VVpkkund.js")).login
 			}),
 			leaf("logout", "Revoke and delete the stored PermDock Cloud login", {
 				examples: ["permdock logout"],
 				docs: "login",
 				effects: ["network", "files"],
 				config: false,
-				load: async () => (await import("./login-DyQNWJok.js")).logout
+				load: async () => (await import("./login-VVpkkund.js")).logout
 			}),
 			leaf("whoami", "Print the PermDock Cloud identity the CLI acts as", {
 				examples: ["permdock whoami", "permdock whoami --json"],
 				docs: "login",
 				effects: [],
 				config: false,
-				load: async () => (await import("./login-DyQNWJok.js")).whoami
+				load: async () => (await import("./login-VVpkkund.js")).whoami
 			}),
 			group("cloud", "Publish to or pull from a PermDock Cloud project", "cloud", [leaf("push", "Publish the catalog, policy and manifest to a Cloud project", {
 				examples: ["permdock cloud push --dry-run", "permdock cloud push --project prj_123"],
 				docs: "cloud",
 				effects: ["network", "cloud:write"],
 				config: true,
-				load: async () => (await import("./cloud-C_Mau1q2.js")).push
+				load: async () => (await import("./cloud-eOtmuonF.js")).push
 			}), leaf("pull", "Write a Cloud project's published catalog and manifest", {
 				examples: ["permdock cloud pull --project prj_123"],
 				docs: "cloud",
 				effects: ["network", "files"],
 				config: true,
-				load: async () => (await import("./cloud-C_Mau1q2.js")).pull
+				load: async () => (await import("./cloud-eOtmuonF.js")).pull
 			})])
 		]
 	},
@@ -333,7 +333,7 @@ const SECTIONS = [
 			docs: "codemod",
 			effects: ["rewrite"],
 			config: false,
-			load: async () => (await import("./codemod-BqYPToUJ.js")).codemod
+			load: async () => (await import("./codemod-D6NYu4AK.js")).codemod
 		})]
 	}
 ];
@@ -345,7 +345,7 @@ const COMPLETE_LEAF = leaf("__complete", "Print completion candidates for a part
 	config: false,
 	shellOutput: true,
 	hidden: true,
-	load: async () => (await import("./completion-Cq4fbT2S.js")).complete
+	load: async () => (await import("./completion-DCza8aQY.js")).complete
 });
 const ROOT = group("permdock", "Collect, export, diff and check the permissions a PermDock policy declares", "", [...SECTIONS.flatMap((section) => section.entries), COMPLETE_LEAF]);
 /** Each leaf with its path from the root, in manifest order. */

package/dist/mcp/index.d.ts

@@ -112,6 +112,24 @@ type McpProcedureEnforcement = {
   readonly permissionFor: (name: string) => Permission | undefined;
   readonly oauthScopesFor?: (name: string) => readonly string[] | undefined;
 };
+/** What an `onError` sink receives next to the thrown error. */
+type McpErrorContext = {
+  /** The key of the permission being checked. */
+  readonly permission: string | null;
+  /** The tool, resource or prompt name. */
+  readonly name: string;
+  /**
+   * The tenant the `tenant` option resolves for the call, or `null` when it
+   * resolves none or throws.
+   */
+  readonly tenant: string | null;
+};
+/**
+ * Receives an error a check threw: a loader, `decide`, an approval input or a
+ * subject a list cannot build. The call still refuses; a sink that throws is
+ * ignored. A `BetterSupabaseOnError` from `permdock/better-supabase` fits.
+ */
+type McpOnError = (error: unknown, context: McpErrorContext) => void;
 type McpPermDockOptions<TUser = unknown> = InstanceOptions & {
   /**
    * Receives the verified auth info, or `{}` on a transport without one
@@ -195,8 +213,8 @@ type McpPermDock = {
    * `permission`.
    */
   readonly protectServer: {
-    (server: McpServer): GuardedMcpServer;
-    (server: McpServer, options: McpProcedureEnforcement): ProcedureMcpServer;
+    (server: McpServer, onError?: McpOnError): GuardedMcpServer;
+    (server: McpServer, options: McpProcedureEnforcement, onError?: McpOnError): ProcedureMcpServer;
   };
 };
 //#endregion
@@ -290,4 +308,4 @@ type McpSubjectOptions = Pick<JwtSubjectOptions, "claims" | "groupRoles" | "sche
  */
 export declare function subjectFromMcp(authInfo: McpAuthInfo | undefined, options?: McpSubjectOptions): Subject<McpPrincipal>;
 //#endregion
-export type { DeniedText, DeniedTextEvent, GuardedMcpServer, McpAuthInfo, McpPermDock, McpPermDockOptions, McpPrincipal, McpProcedureEnforcement, McpProcedureToolConfig, McpPromptConfig, McpResourceConfig, McpResourceGuardOptions, McpResourceGuardResult, McpSubjectOptions, McpToolConfig, McpUiResourceConfig, ProcedureMcpServer, ProtectedResourceMetadataOptions };
+export type { DeniedText, DeniedTextEvent, GuardedMcpServer, McpAuthInfo, McpErrorContext, McpOnError, McpPermDock, McpPermDockOptions, McpPrincipal, McpProcedureEnforcement, McpProcedureToolConfig, McpPromptConfig, McpResourceConfig, McpResourceGuardOptions, McpResourceGuardResult, McpSubjectOptions, McpToolConfig, McpUiResourceConfig, ProcedureMcpServer, ProtectedResourceMetadataOptions };