permdock 0.5.0 → 0.7.0

package/dist/{manifest-CtKR3GXL.js → manifest-Dv6q4i5s.js}

@@ -30,20 +30,20 @@ const SECTIONS = [
 				docs: "init",
 				effects: ["files"],
 				config: false,
-				load: async () => (await import("./init-GG6Jh8HD.js")).init
+				load: async () => (await import("./init-5TXNji88.js")).init
 			}),
 			group("preset", "Decode a preset code, or print its permdock.com/create link", "preset", [leaf("decode", "Print what a preset code holds", {
 				examples: ["permdock preset decode p1AQIDBAc"],
 				docs: "preset",
 				effects: [],
 				config: false,
-				load: async () => (await import("./init-GG6Jh8HD.js")).presetDecode
+				load: async () => (await import("./init-5TXNji88.js")).presetDecode
 			}), leaf("url", "Print the permdock.com/create link that opens a code", {
 				examples: ["permdock preset url p1AQIDBAc"],
 				docs: "preset",
 				effects: [],
 				config: false,
-				load: async () => (await import("./init-GG6Jh8HD.js")).presetUrl
+				load: async () => (await import("./init-5TXNji88.js")).presetUrl
 			})]),
 			group("skills", "Install, update or list the PermDock Agent Skills", "skills", [
 				leaf("install", "Copy the Agent Skills into the agent folders", {
@@ -55,21 +55,21 @@ const SECTIONS = [
 					docs: "skills",
 					effects: ["files"],
 					config: false,
-					load: async () => (await import("./skills-CTYwkl44.js")).install
+					load: async () => (await import("./skills-g_3BS9NC.js")).install
 				}),
 				leaf("update", "Replace installed skills with this version's", {
 					examples: ["permdock skills update"],
 					docs: "skills",
 					effects: ["files"],
 					config: false,
-					load: async () => (await import("./skills-CTYwkl44.js")).update
+					load: async () => (await import("./skills-g_3BS9NC.js")).update
 				}),
 				leaf("list", "List the skills and where each is installed", {
 					examples: ["permdock skills list"],
 					docs: "skills",
 					effects: [],
 					config: false,
-					load: async () => (await import("./skills-CTYwkl44.js")).list
+					load: async () => (await import("./skills-g_3BS9NC.js")).list
 				})
 			]),
 			leaf("doctor", "Check a PermDock installation and print a fix for each finding", {
@@ -82,7 +82,7 @@ const SECTIONS = [
 				effects: ["files"],
 				config: true,
 				findings: true,
-				load: async () => (await import("./doctor-CxiwSfqH.js")).doctor
+				load: async () => (await import("./doctor-BoK_y0KO.js")).doctor
 			}),
 			leaf("completion", "Print the shell completion script for bash, zsh or fish", {
 				examples: ["permdock completion zsh > ~/.zfunc/_permdock", "eval \"$(permdock completion bash)\""],
@@ -90,7 +90,7 @@ const SECTIONS = [
 				effects: [],
 				config: false,
 				shellOutput: true,
-				load: async () => (await import("./completion-BqhRBJD8.js")).completion
+				load: async () => (await import("./completion-BNdVf7X2.js")).completion
 			})
 		]
 	},
@@ -106,14 +106,14 @@ const SECTIONS = [
 				docs: "collect",
 				effects: ["files"],
 				config: true,
-				load: async () => (await import("./collect-DloHbDVa.js")).collect
+				load: async () => (await import("./collect-DNm3oKOk.js")).collect
 			}),
 			leaf("catalog", "Export the catalog as catalog JSON, JSON Schema or Markdown", {
 				examples: ["permdock catalog --out permissions.catalog.json", "permdock catalog --kind markdown"],
 				docs: "catalog",
 				effects: ["files"],
 				config: true,
-				load: async () => (await import("./catalog-R_A__RsH.js")).catalog
+				load: async () => (await import("./catalog-BaMQfQ6Y.js")).catalog
 			}),
 			leaf("usage", "Report unused, ungranted and role-less permissions and conditions on undeclared fields", {
 				examples: ["permdock usage", "permdock usage --fail-on warning"],
@@ -121,14 +121,14 @@ const SECTIONS = [
 				effects: [],
 				config: true,
 				findings: true,
-				load: async () => (await import("./usage-DHtE8j4E.js")).usage
+				load: async () => (await import("./usage-CDaLXCfL.js")).usage
 			}),
 			leaf("diff", "Compare two policies or catalogs; exit 1 on a breaking change", {
 				examples: ["permdock diff main.catalog.json permissions.catalog.json", "permdock diff ./old-policy.ts ./src/policy.ts --impact"],
 				docs: "diff",
 				effects: [],
 				config: true,
-				load: async () => (await import("./diff-CxZo9pTq.js")).diff
+				load: async () => (await import("./diff-Btr1c1Ow.js")).diff
 			}),
 			leaf("config", "Check permdock.config.ts for unknown keys, or print the effective config", {
 				examples: ["permdock config", "permdock config --print"],
@@ -136,7 +136,7 @@ const SECTIONS = [
 				effects: [],
 				config: true,
 				findings: true,
-				load: async () => (await import("./config-B46rm9sc.js")).config
+				load: async () => (await import("./config-DGZzMV1B.js")).config
 			})
 		]
 	},
@@ -153,14 +153,14 @@ const SECTIONS = [
 						"network"
 					],
 					config: true,
-					load: async () => (await import("./rls-BA8an5Ap.js")).generate
+					load: async () => (await import("./rls-Ck_PocSp.js")).generate
 				}),
 				leaf("import", "Turn existing RLS policies into a generated definition", {
 					examples: ["permdock rls import --sql schema.sql --out src/permissions.generated.ts", "permdock rls import --db-url-stdin --out src/permissions.generated.ts"],
 					docs: "rls",
 					effects: ["files", "database:read"],
 					config: true,
-					load: async () => (await import("./rls-BA8an5Ap.js")).importPolicies
+					load: async () => (await import("./rls-Ck_PocSp.js")).importPolicies
 				}),
 				leaf("verify", "Run the fixtures against the policies, or compare a live database", {
 					examples: [
@@ -169,16 +169,24 @@ const SECTIONS = [
 						"permdock rls verify --introspect --db-url-stdin"
 					],
 					docs: "rls",
-					effects: ["database:read"],
+					effects: ["files", "database:read"],
 					config: true,
-					load: async () => (await import("./rls-BA8an5Ap.js")).verify
+					findings: true,
+					load: async () => (await import("./rls-Ck_PocSp.js")).verify
 				}),
 				leaf("migrate", "Rewrite hand-written policies onto the generated helpers", {
 					examples: ["permdock rls migrate --sql supabase/migrations --dry-run", "permdock rls migrate --sql supabase/migrations"],
 					docs: "rls",
 					effects: ["rewrite", "files"],
 					config: true,
-					load: async () => (await import("./rls-BA8an5Ap.js")).migrate
+					load: async () => (await import("./rls-Ck_PocSp.js")).migrate
+				}),
+				leaf("explain", "Show the tables, membership sources and triggers the SQL binds to", {
+					examples: ["permdock rls explain", "permdock rls explain --db-url-stdin --json"],
+					docs: "rls",
+					effects: ["database:read"],
+					config: true,
+					load: async () => (await import("./rls-Ck_PocSp.js")).explain
 				})
 			]),
 			group("supabase", "Generate the Supabase Custom Access Token Hook, or inspect its manifest", "supabase", [group("hook", "The Custom Access Token Hook", "supabase", [leaf("generate", "Compile the membership sources into the hook migration", {
@@ -186,26 +194,37 @@ const SECTIONS = [
 				docs: "supabase",
 				effects: ["files", "database:read"],
 				config: true,
-				load: async () => (await import("./supabase-9pqI57pW.js")).hookGenerate
+				load: async () => (await import("./supabase-Bqp7iIY2.js")).hookGenerate
 			})]), leaf("inspect", "Print or write the hook and helper manifest", {
 				examples: ["permdock supabase inspect", "permdock supabase inspect --out"],
 				docs: "supabase",
 				effects: ["files"],
 				config: true,
-				load: async () => (await import("./supabase-9pqI57pW.js")).inspect
+				load: async () => (await import("./supabase-Bqp7iIY2.js")).inspect
 			})]),
 			group("powersync", "Generate PowerSync Sync Streams from the policy, or verify them", "powersync", [leaf("generate", "Compile the read grants into sync-config.yaml", {
 				examples: ["permdock powersync generate", "permdock powersync generate --check"],
 				docs: "powersync",
 				effects: ["files"],
 				config: true,
-				load: async () => (await import("./powersync-BHfuehf3.js")).generate
+				load: async () => (await import("./powersync-13odBwiM.js")).generate
 			}), leaf("verify", "Fail on stale streams or a stream that syncs a denied row", {
 				examples: ["permdock powersync verify", "permdock powersync verify --db-url-stdin"],
 				docs: "powersync",
 				effects: ["database:read"],
 				config: true,
-				load: async () => (await import("./powersync-BHfuehf3.js")).verify
+				load: async () => (await import("./powersync-13odBwiM.js")).verify
+			})]),
+			group("scim", "Generate the Postgres tables postgresDirectoryStore keeps a SCIM directory in", "scim", [leaf("generate", "Write the tenant-keyed users, groups and members tables", {
+				examples: [
+					"permdock scim generate",
+					"permdock scim generate --dialect guc --out db/scim.sql",
+					"permdock scim generate --check"
+				],
+				docs: "scim",
+				effects: ["files"],
+				config: true,
+				load: async () => (await import("./scim-C7JYhySg.js")).generate
 			})])
 		]
 	},
@@ -217,13 +236,13 @@ const SECTIONS = [
 				docs: "openapi",
 				effects: ["files"],
 				config: true,
-				load: async () => (await import("./openapi-ahr8rHu3.js")).emit
+				load: async () => (await import("./openapi-DMocl1bh.js")).emit
 			}), leaf("import", "Turn an OpenAPI document into a generated definition", {
 				examples: ["permdock openapi import --doc openapi.yaml --out src/permissions.generated.ts"],
 				docs: "openapi",
 				effects: ["files", "network"],
 				config: false,
-				load: async () => (await import("./openapi-ahr8rHu3.js")).importDocument
+				load: async () => (await import("./openapi-DMocl1bh.js")).importDocument
 			})]),
 			group("arazzo", "Check Arazzo workflows against the permissions", "arazzo", [leaf("check", "Resolve every Arazzo step to x-permdock-permissions", {
 				examples: ["permdock arazzo check --doc arazzo.json --openapi openapi.json"],
@@ -231,7 +250,7 @@ const SECTIONS = [
 				effects: [],
 				config: true,
 				findings: true,
-				load: async () => (await import("./arazzo-B6lebmiQ.js")).check
+				load: async () => (await import("./arazzo-ClrF3PVb.js")).check
 			})]),
 			leaf("scan", "List authorization checks written without PermDock, to adopt it in an existing app", {
 				examples: ["permdock scan", "permdock scan --src app,lib --pattern isBeta"],
@@ -239,21 +258,21 @@ const SECTIONS = [
 				effects: [],
 				config: true,
 				findings: true,
-				load: async () => (await import("./scan-BOI5tJ-6.js")).scan
+				load: async () => (await import("./scan-DSljDE1Y.js")).scan
 			}),
 			group("casl", "Import CASL rules into a generated module", "casl", [leaf("import", "Turn CASL rules per role into a permissions and policy module", {
 				examples: ["permdock casl import --rules rules.json --out src/permissions.generated.ts"],
 				docs: "casl",
 				effects: ["files"],
 				config: false,
-				load: async () => (await import("./casl-64gpT-8x.js")).caslImport
+				load: async () => (await import("./casl-CmJlgziS.js")).caslImport
 			})]),
 			group("casbin", "Import a Casbin model and policy into a generated module", "casbin", [leaf("import", "Turn a Casbin RBAC model and policy into a permissions and policy module", {
 				examples: ["permdock casbin import --model model.conf --policy policy.csv --out src/permissions.generated.ts"],
 				docs: "casbin",
 				effects: ["files"],
 				config: false,
-				load: async () => (await import("./casbin-Cr7RLtA3.js")).casbinImport
+				load: async () => (await import("./casbin-BHijLuHY.js")).casbinImport
 			})])
 		]
 	},
@@ -265,34 +284,34 @@ const SECTIONS = [
 				docs: "login",
 				effects: ["network", "files"],
 				config: false,
-				load: async () => (await import("./login-Dfe5RlYk.js")).login
+				load: async () => (await import("./login-ClSJh5t5.js")).login
 			}),
 			leaf("logout", "Revoke and delete the stored PermDock Cloud login", {
 				examples: ["permdock logout"],
 				docs: "login",
 				effects: ["network", "files"],
 				config: false,
-				load: async () => (await import("./login-Dfe5RlYk.js")).logout
+				load: async () => (await import("./login-ClSJh5t5.js")).logout
 			}),
 			leaf("whoami", "Print the PermDock Cloud identity the CLI acts as", {
 				examples: ["permdock whoami", "permdock whoami --json"],
 				docs: "login",
 				effects: [],
 				config: false,
-				load: async () => (await import("./login-Dfe5RlYk.js")).whoami
+				load: async () => (await import("./login-ClSJh5t5.js")).whoami
 			}),
 			group("cloud", "Publish to or pull from a PermDock Cloud project", "cloud", [leaf("push", "Publish the catalog, policy and manifest to a Cloud project", {
 				examples: ["permdock cloud push --dry-run", "permdock cloud push --project prj_123"],
 				docs: "cloud",
 				effects: ["network", "cloud:write"],
 				config: true,
-				load: async () => (await import("./cloud-CIoHNevm.js")).push
+				load: async () => (await import("./cloud-CO8pYtwr.js")).push
 			}), leaf("pull", "Write a Cloud project's published catalog and manifest", {
 				examples: ["permdock cloud pull --project prj_123"],
 				docs: "cloud",
 				effects: ["network", "files"],
 				config: true,
-				load: async () => (await import("./cloud-CIoHNevm.js")).pull
+				load: async () => (await import("./cloud-CO8pYtwr.js")).pull
 			})])
 		]
 	},
@@ -303,7 +322,7 @@ const SECTIONS = [
 			docs: "codemod",
 			effects: ["rewrite"],
 			config: false,
-			load: async () => (await import("./codemod-Bmj9dWMH.js")).codemod
+			load: async () => (await import("./codemod-i4N2BhDc.js")).codemod
 		})]
 	}
 ];
@@ -315,7 +334,7 @@ const COMPLETE_LEAF = leaf("__complete", "Print completion candidates for a part
 	config: false,
 	shellOutput: true,
 	hidden: true,
-	load: async () => (await import("./completion-BqhRBJD8.js")).complete
+	load: async () => (await import("./completion-BNdVf7X2.js")).complete
 });
 const ROOT = group("permdock", "Collect, export, diff and check the permissions a PermDock policy declares", "", [...SECTIONS.flatMap((section) => section.entries), COMPLETE_LEAF]);
 /** Each leaf with its path from the root, in manifest order. */

package/dist/{manifest-schema-C0kK_8V0.js → manifest-schema-Cv492Qev.js}

@@ -10,13 +10,8 @@ const supabaseManifestSchema = freezeDeep({
 	required: [
 		"$schema",
 		"version",
-		"hook",
 		"helpers",
 		"tenantClaim",
-		"budget",
-		"claims",
-		"authzVersion",
-		"memberships",
 		"rls",
 		"decidingColumns",
 		"markers"
@@ -95,6 +90,24 @@ const supabaseManifestSchema = freezeDeep({
 			}
 		},
 		authzVersion: { type: "boolean" },
+		managementApi: {
+			description: "The Management API fields that make a hosted project call the generated hook, as `permdock supabase inspect` prints and `--out` writes them.",
+			type: "object",
+			required: [
+				"hook_custom_access_token_enabled",
+				"hook_custom_access_token_uri",
+				"jwt_exp"
+			],
+			properties: {
+				hook_custom_access_token_enabled: { const: true },
+				hook_custom_access_token_uri: { type: "string" },
+				jwt_exp: {
+					description: "The access token lifetime in seconds: `[auth] jwt_expiry` of `supabase/config.toml`, or 3600 when it is unset.",
+					type: "integer"
+				}
+			},
+			additionalProperties: false
+		},
 		authzVersionBump: {
 			type: "object",
 			required: [
@@ -222,6 +235,7 @@ const supabaseManifestSchema = freezeDeep({
 						items: { type: "string" }
 					} }
 				},
+				tokenScopes: { type: "boolean" },
 				apiKeys: {
 					type: "object",
 					required: [
@@ -349,7 +363,7 @@ const supabaseManifestSchema = freezeDeep({
 		},
 		helperName: {
 			type: "string",
-			pattern: "^(permdock_has(_for)?|permitted_[a-z][a-z0-9_]*_(ids|permission_keys)(_for)?|permitted_[a-z][a-z0-9_]*_users|member_[a-z][a-z0-9_]*_ids(_for)?|permdock_can_assign(_any|_custom_role)?(_for)?|permdock_api_key_allows|permdock_actor_may_write|permdock_is_approver|permdock_user_id)$"
+			pattern: "^(permdock_has(_for)?|permitted_[a-z][a-z0-9_]*_(ids|permission_keys)(_for)?|permitted_[a-z][a-z0-9_]*_users|member_[a-z][a-z0-9_]*_ids(_for)?|permdock_can_assign(_any|_custom_role)?(_for)?|permdock_api_key_allows|permdock_token_scope_allows|permdock_actor_may_write|permdock_is_approver|permdock_user_id)$"
 		},
 		column: {
 			type: "object",
@@ -357,7 +371,23 @@ const supabaseManifestSchema = freezeDeep({
 			additionalProperties: false,
 			properties: { column: { $ref: "#/$defs/identifier" } }
 		},
-		role: { oneOf: [{ $ref: "#/$defs/value" }, { $ref: "#/$defs/through" }] },
+		role: { oneOf: [
+			{ $ref: "#/$defs/value" },
+			{ $ref: "#/$defs/through" },
+			{ $ref: "#/$defs/mapped" }
+		] },
+		mapped: {
+			type: "object",
+			required: ["column", "map"],
+			additionalProperties: false,
+			properties: {
+				column: { $ref: "#/$defs/identifier" },
+				map: {
+					type: "object",
+					additionalProperties: { type: ["string", "null"] }
+				}
+			}
+		},
 		user: { oneOf: [{ $ref: "#/$defs/column" }, { $ref: "#/$defs/through" }] },
 		through: {
 			type: "object",

package/dist/{map-claims-D3oRmTk0.js → map-claims-etGIS_Dv.js}

@@ -338,19 +338,22 @@ function mapClaimsToSubject(claims, options) {
 		invalidChain: false
 	};
 }
+/** `true` when a verified token is not an OpenID Connect ID token for one of `clients`. */
+function idTokenMismatch(claims, headerTyp, clients) {
+	const typ = headerTyp?.toLowerCase();
+	if (typ !== void 0 && typ !== "jwt" && typ !== "application/jwt") return true;
+	if (typeof claims.iat !== "number") return true;
+	const aud = claims.aud;
+	const audiences = Array.isArray(aud) ? aud : aud === void 0 ? [] : [aud];
+	const expected = clients === void 0 ? [] : typeof clients === "string" ? [clients] : clients;
+	const azp = claims["azp"];
+	if (azp === void 0) return audiences.length > 1;
+	return typeof azp !== "string" || !expected.includes(azp);
+}
 function acceptMismatch(claims, headerTyp, options, audience) {
 	const accept = options.accept ?? "access-token";
 	const typ = headerTyp?.toLowerCase();
-	if (accept === "id-token") {
-		if (typ !== void 0 && typ !== "jwt" && typ !== "application/jwt") return true;
-		if (typeof claims.iat !== "number") return true;
-		const aud = claims.aud;
-		const audiences = Array.isArray(aud) ? aud : aud === void 0 ? [] : [aud];
-		const clients = audience === void 0 ? [] : typeof audience === "string" ? [audience] : audience;
-		const azp = claims["azp"];
-		if (azp === void 0) return audiences.length > 1;
-		return typeof azp !== "string" || !clients.includes(azp);
-	}
+	if (accept === "id-token") return idTokenMismatch(claims, headerTyp, audience);
 	if (options.profile === "fapi2" && typ !== "at+jwt") return true;
 	if (typeof claims["nonce"] === "string") return true;
 	if (audience !== void 0 && typeof claims.aud === "string") {
@@ -360,4 +363,4 @@ function acceptMismatch(claims, headerTyp, options, audience) {
 	return false;
 }
 //#endregion
-export { mapClaimsToSubject as n, validateCustomClaims as r, acceptMismatch as t };
+export { validateCustomClaims as i, idTokenMismatch as n, mapClaimsToSubject as r, acceptMismatch as t };

package/dist/{map-error-TCAdw-eW.js → map-error-BQGyDm_M.js}

@@ -2,7 +2,7 @@ import { t as compact } from "./compact-CAf557ZB.js";
 import { n as PermDockValidationError } from "./validation-error-ZfUHbKvf.js";
 import { n as PermDockDeniedError, r as PermDockRevokedError, t as PermDockApprovalRequiredError } from "./errors-BKy0EfhN.js";
 import { c as problemResponse, i as decisionResponse } from "./problem-CTviyH5L.js";
-import { u as InvalidSignatureError } from "./evaluations-DZ2CbV5k.js";
+import { l as InvalidSignatureError } from "./evaluations-DReoiVBw.js";
 //#region src/server/map-error.ts
 /**
 * Turns a thrown PermDock error into its Problem Details response, with the

package/dist/mcp/index.d.ts

@@ -1,14 +1,14 @@
-import { $n as Delegation, T as Policy, ir as Subject, rr as Principal } from "../policy-types-DzwivBgR.js";
-import { w as Permission } from "../vocabulary-D6lPdb4Z.js";
-import { m as ApprovalStore } from "../types-CCpc2Dcv.js";
-import { t as ApprovalHint } from "../errors-C2PXIv4c.js";
-import { t as InstanceOptions } from "../instance-options-Omfd793B.js";
+import { T as Policy, Y as JwtClaims, dt as TokenVerifier, lr as Subject, rr as Delegation, sr as Principal } from "../policy-types-B-F-qAZk.js";
+import { u as Permission } from "../permission-types-DhNEmoRG.js";
+import { m as ApprovalStore } from "../types-DC44-hqb.js";
+import { t as ApprovalHint } from "../errors-B_Qg9D3e.js";
+import { t as InstanceOptions } from "../instance-options-CU0YQCLH.js";
 import { t as RequestContext } from "../request-context-C2_1lchh.js";
-import { n as PermDockWrap } from "../wrap-Bd1Tejur.js";
-import { o as OtelWrap } from "../types-BqAKcRNW.js";
-import { n as DeniedTextEvent, t as DeniedText } from "../denied-text-D8jDHgsl.js";
+import { n as PermDockWrap } from "../wrap-B6R0cMRL.js";
+import { o as OtelWrap } from "../types-CIeZcG8v.js";
+import { n as DeniedTextEvent, t as DeniedText } from "../denied-text-D4qkEtFz.js";
 import { t as ClientNames } from "../clients-C7zLFuWT.js";
-import { U as JwtSubjectOptions } from "../types-DiQjupG2.js";
+import { U as JwtSubjectOptions } from "../types-cTos-H7p.js";
 import { CacheHint, Icon, McpServer, PromptCallback, ReadResourceCallback, ReadResourceTemplateCallback, RegisteredPrompt, RegisteredResource, RegisteredResourceTemplate, RegisteredTool, ResourceMetadata, ResourceTemplate, ScopeChallengeHandler, StandardSchemaWithJSON, ToolAnnotations, ToolCallback, Variables } from "@modelcontextprotocol/server";
 //#region src/mcp/types.d.ts
 /** The verified `AuthInfo` the MCP SDK's bearer auth puts on `ctx.http.authInfo`. */
@@ -54,6 +54,13 @@ type McpResourceConfig<TArgs extends readonly unknown[]> = Guard<TArgs> & Resour
   readonly cacheHint?: CacheHint;
   readonly scopeChallenge?: ScopeChallengeHandler;
 };
+/**
+ * An MCP Apps view (`ui://`). Without `permission` it takes the permission of
+ * the tool whose `_meta.ui.resourceUri` names it, and denies while no tool does.
+ */
+type McpUiResourceConfig = Omit<McpResourceConfig<[uri: URL]>, "permission"> & {
+  readonly permission?: Permission;
+};
 type McpPromptConfig<TArgs extends StandardSchemaWithJSON | undefined = undefined> = Guard<[args: InputOf<TArgs>]> & {
   readonly title?: string;
   readonly description?: string;
@@ -65,6 +72,7 @@ type McpPromptConfig<TArgs extends StandardSchemaWithJSON | undefined = undefine
 /** `McpServer` whose `register*` methods take a `permission` and decide first. */
 type GuardedMcpServer = Omit<McpServer, "registerTool" | "registerResource" | "registerPrompt"> & {
   registerTool<TInput extends StandardSchemaWithJSON | undefined = undefined, TOutput extends StandardSchemaWithJSON | undefined = undefined>(name: string, config: McpToolConfig<TInput, TOutput>, handler: ToolCallback<TInput>): RegisteredTool;
+  registerResource(name: string, uri: `ui://${string}`, config: McpUiResourceConfig, read: ReadResourceCallback): RegisteredResource;
   registerResource(name: string, uri: string, config: McpResourceConfig<[uri: URL]>, read: ReadResourceCallback): RegisteredResource;
   registerResource(name: string, template: ResourceTemplate, config: McpResourceConfig<[uri: URL, variables: Variables]>, read: ReadResourceTemplateCallback): RegisteredResourceTemplate;
   registerPrompt<TArgs extends StandardSchemaWithJSON | undefined = undefined>(name: string, config: McpPromptConfig<TArgs>, handler: PromptCallback<TArgs>): RegisteredPrompt;
@@ -166,6 +174,52 @@ export declare function createPermDock<TUser, TPrincipal extends Principal = Pri
 /** `_meta` key on `tools/call`, `resources/read` and `prompts/get` carrying an approval token. */
 export declare const APPROVAL_META_KEY = "dev.permdock/approval";
 //#endregion
+//#region src/mcp/resource-guard.d.ts
+type McpResourceGuardOptions = {
+  /** The MCP server's resource identifier (RFC 8707); a token's `aud` must contain it. */
+  readonly resource: string | URL;
+  /** Scopes every request needs; a token without one of them gets `403 insufficient_scope`. */
+  readonly scopes?: readonly string[];
+  readonly verifier: TokenVerifier;
+  /** The authorization server's issuer, when the verifier does not check `iss` itself. */
+  readonly issuer?: string;
+  /** `true` for a revoked token; a throw also refuses it. */
+  readonly revoked?: (claims: JwtClaims) => boolean | Promise<boolean>;
+  /** The RFC 9728 metadata URL in challenges; default `<origin>/.well-known/oauth-protected-resource<path>`. */
+  readonly resourceMetadataUrl?: string;
+};
+type McpResourceGuardResult = {
+  readonly ok: true;
+  readonly authInfo: McpAuthInfo;
+} | {
+  readonly ok: false;
+  readonly response: Response;
+};
+type ProtectedResourceMetadataOptions = {
+  readonly resource: string | URL;
+  /** `authorization_servers`: the issuers whose tokens the resource accepts. */
+  readonly authorizationServers: readonly string[];
+  /** `scopes_supported`; list every permission's `scope` so clients can ask for them up front. */
+  readonly scopesSupported?: readonly string[];
+  readonly resourceName?: string;
+  readonly resourceDocumentation?: string;
+};
+/**
+ * The resource-server check in front of an MCP endpoint (MCP authorization,
+ * RFC 6750, RFC 9728): reads the bearer token from `Authorization`, verifies
+ * it for `resource`, refuses a revoked one and checks `scopes`. It answers
+ * the `McpAuthInfo` the SDK's handlers read, or the `401` or `403` response
+ * with a `WWW-Authenticate` challenge naming the metadata URL. A token in the
+ * query string is never read. Never throws.
+ */
+export declare function mcpResourceGuard(options: McpResourceGuardOptions): (request: Request) => Promise<McpResourceGuardResult>;
+/**
+ * The RFC 9728 Protected Resource Metadata document as a Fetch handler, for
+ * `/.well-known/oauth-protected-resource<path>`. `bearer_methods_supported`
+ * is `header`, the only method `mcpResourceGuard` reads. Any origin may read it.
+ */
+export declare function protectedResourceMetadata(options: ProtectedResourceMetadataOptions): (request: Request) => Response;
+//#endregion
 //#region src/mcp/subject.d.ts
 type McpSubjectOptions = Pick<JwtSubjectOptions, "claims" | "groupRoles" | "schema" | "delegation"> & {
   /** The `kind` of the actor built from `authInfo.clientId`; `'mcp-client'` when absent. Match `createPermDock`'s `actorKind`. */
@@ -183,4 +237,4 @@ type McpSubjectOptions = Pick<JwtSubjectOptions, "claims" | "groupRoles" | "sche
  */
 export declare function subjectFromMcp(authInfo: McpAuthInfo | undefined, options?: McpSubjectOptions): Subject<McpPrincipal>;
 //#endregion
-export type { DeniedText, DeniedTextEvent, GuardedMcpServer, McpAuthInfo, McpPermDock, McpPermDockOptions, McpPrincipal, McpProcedureEnforcement, McpProcedureToolConfig, McpPromptConfig, McpResourceConfig, McpSubjectOptions, McpToolConfig, ProcedureMcpServer };
+export type { DeniedText, DeniedTextEvent, GuardedMcpServer, McpAuthInfo, McpPermDock, McpPermDockOptions, McpPrincipal, McpProcedureEnforcement, McpProcedureToolConfig, McpPromptConfig, McpResourceConfig, McpResourceGuardOptions, McpResourceGuardResult, McpSubjectOptions, McpToolConfig, McpUiResourceConfig, ProcedureMcpServer, ProtectedResourceMetadataOptions };