permdock 0.6.0 → 0.7.0

package/dist/{manifest-mx5ghSFM.d.ts → manifest-BVhExYhw.d.ts}

@@ -48,6 +48,12 @@ type SupabaseHookManifest = {
     readonly function: "permdock_bump_authz_version_for";
     readonly args: "p_users uuid[]";
   };
+  /** The Management API fields that make a hosted project call the hook; `permdock supabase inspect` adds them. */
+  readonly managementApi?: {
+    readonly hook_custom_access_token_enabled: true;
+    readonly hook_custom_access_token_uri: string;
+    readonly jwt_exp: number;
+  };
   /** The `supabase.hook.memberships` sources, in the order the hook reads them. */
   readonly memberships: readonly SupabaseManifestMembership[];
   readonly rls: SupabaseManifestRls;
@@ -97,6 +103,9 @@ type SupabaseManifestThrough = {
 /** A role column (with `through` when it references a roles table), or the fixed roles every row holds. */
 type SupabaseManifestRole = SupabaseManifestValue | (SupabaseManifestColumn & {
   readonly through: SupabaseManifestThrough;
+}) | (SupabaseManifestColumn & {
+  /** Each column value to the role key it stands for, or `null` for no role; an unlisted value is no role. */
+  readonly map: Readonly<Record<string, string | null>>;
 });
 /** One `tableMembershipSource` or `junctionMembershipSource` source. */
 type SupabaseManifestMembership = {
@@ -194,6 +203,8 @@ type SupabaseManifestRls = {
   readonly assignments?: {
     readonly tables: readonly string[];
   };
+  /** `rls.tokenScopes`: the helpers narrow a delegated token by its `scope` claim through `permdock_token_scope_allows`. */
+  readonly tokenScopes?: boolean;
   readonly apiKeys?: {
     readonly claim: string;
     readonly scopes: string;
@@ -202,12 +213,22 @@ type SupabaseManifestRls = {
     readonly serviceRoles: readonly string[];
   };
 };
+/**
+ * The manifest of a project in `rls.authorize: 'database'` mode without
+ * `supabase.hook`: no token hook, so no `hook`, `budget`, `claims`,
+ * `authzVersion` or hook `memberships`.
+ */
+type SupabaseDatabaseManifest = Omit<SupabaseHookManifest, "authzVersion" | "authzVersionBump" | "budget" | "claims" | "hook" | "managementApi" | "memberships">;
+/** What `parseSupabaseManifest` returns: a manifest with or without the token hook. */
+type SupabaseManifest = SupabaseDatabaseManifest | SupabaseHookManifest;
+/** Whether the manifest describes a token hook. */
+declare function hasTokenHook(manifest: SupabaseManifest): manifest is SupabaseHookManifest;
 /**
  * Reads a `permdock.manifest.json` document (parsed, or the JSON text) and
  * validates it against `schemas/supabase-manifest-v1.json`. Returns a
  * deep-frozen copy built from own keys; throws `PermDockValidationError`
  * with every issue, so a manifest of another major is refused.
  */
-declare function parseSupabaseManifest(json: unknown): SupabaseHookManifest;
+declare function parseSupabaseManifest(json: unknown): SupabaseManifest;
 //#endregion
-export { SupabaseManifestHelper as a, SupabaseManifestRls as c, SupabaseManifestValue as d, parseSupabaseManifest as f, SupabaseManifestColumn as i, SupabaseManifestRole as l, SupabaseHookManifest as n, SupabaseManifestMembership as o, SupabaseManifestActiveRow as r, SupabaseManifestRequires as s, SupabaseHookClaim as t, SupabaseManifestThrough as u };
+export { SupabaseManifestActiveRow as a, SupabaseManifestMembership as c, SupabaseManifestRole as d, SupabaseManifestThrough as f, parseSupabaseManifest as h, SupabaseManifest as i, SupabaseManifestRequires as l, hasTokenHook as m, SupabaseHookClaim as n, SupabaseManifestColumn as o, SupabaseManifestValue as p, SupabaseHookManifest as r, SupabaseManifestHelper as s, SupabaseDatabaseManifest as t, SupabaseManifestRls as u };

package/dist/{manifest-dvL2XEe1.js → manifest-Dv6q4i5s.js}

@@ -30,20 +30,20 @@ const SECTIONS = [
 				docs: "init",
 				effects: ["files"],
 				config: false,
-				load: async () => (await import("./init-GG6Jh8HD.js")).init
+				load: async () => (await import("./init-5TXNji88.js")).init
 			}),
 			group("preset", "Decode a preset code, or print its permdock.com/create link", "preset", [leaf("decode", "Print what a preset code holds", {
 				examples: ["permdock preset decode p1AQIDBAc"],
 				docs: "preset",
 				effects: [],
 				config: false,
-				load: async () => (await import("./init-GG6Jh8HD.js")).presetDecode
+				load: async () => (await import("./init-5TXNji88.js")).presetDecode
 			}), leaf("url", "Print the permdock.com/create link that opens a code", {
 				examples: ["permdock preset url p1AQIDBAc"],
 				docs: "preset",
 				effects: [],
 				config: false,
-				load: async () => (await import("./init-GG6Jh8HD.js")).presetUrl
+				load: async () => (await import("./init-5TXNji88.js")).presetUrl
 			})]),
 			group("skills", "Install, update or list the PermDock Agent Skills", "skills", [
 				leaf("install", "Copy the Agent Skills into the agent folders", {
@@ -55,21 +55,21 @@ const SECTIONS = [
 					docs: "skills",
 					effects: ["files"],
 					config: false,
-					load: async () => (await import("./skills-CTYwkl44.js")).install
+					load: async () => (await import("./skills-g_3BS9NC.js")).install
 				}),
 				leaf("update", "Replace installed skills with this version's", {
 					examples: ["permdock skills update"],
 					docs: "skills",
 					effects: ["files"],
 					config: false,
-					load: async () => (await import("./skills-CTYwkl44.js")).update
+					load: async () => (await import("./skills-g_3BS9NC.js")).update
 				}),
 				leaf("list", "List the skills and where each is installed", {
 					examples: ["permdock skills list"],
 					docs: "skills",
 					effects: [],
 					config: false,
-					load: async () => (await import("./skills-CTYwkl44.js")).list
+					load: async () => (await import("./skills-g_3BS9NC.js")).list
 				})
 			]),
 			leaf("doctor", "Check a PermDock installation and print a fix for each finding", {
@@ -82,7 +82,7 @@ const SECTIONS = [
 				effects: ["files"],
 				config: true,
 				findings: true,
-				load: async () => (await import("./doctor-3ZqNHX_G.js")).doctor
+				load: async () => (await import("./doctor-BoK_y0KO.js")).doctor
 			}),
 			leaf("completion", "Print the shell completion script for bash, zsh or fish", {
 				examples: ["permdock completion zsh > ~/.zfunc/_permdock", "eval \"$(permdock completion bash)\""],
@@ -90,7 +90,7 @@ const SECTIONS = [
 				effects: [],
 				config: false,
 				shellOutput: true,
-				load: async () => (await import("./completion-BTFrHZhX.js")).completion
+				load: async () => (await import("./completion-BNdVf7X2.js")).completion
 			})
 		]
 	},
@@ -106,14 +106,14 @@ const SECTIONS = [
 				docs: "collect",
 				effects: ["files"],
 				config: true,
-				load: async () => (await import("./collect-Ci6akVwH.js")).collect
+				load: async () => (await import("./collect-DNm3oKOk.js")).collect
 			}),
 			leaf("catalog", "Export the catalog as catalog JSON, JSON Schema or Markdown", {
 				examples: ["permdock catalog --out permissions.catalog.json", "permdock catalog --kind markdown"],
 				docs: "catalog",
 				effects: ["files"],
 				config: true,
-				load: async () => (await import("./catalog-DZVbrF-z.js")).catalog
+				load: async () => (await import("./catalog-BaMQfQ6Y.js")).catalog
 			}),
 			leaf("usage", "Report unused, ungranted and role-less permissions and conditions on undeclared fields", {
 				examples: ["permdock usage", "permdock usage --fail-on warning"],
@@ -121,14 +121,14 @@ const SECTIONS = [
 				effects: [],
 				config: true,
 				findings: true,
-				load: async () => (await import("./usage-CRVl9V3t.js")).usage
+				load: async () => (await import("./usage-CDaLXCfL.js")).usage
 			}),
 			leaf("diff", "Compare two policies or catalogs; exit 1 on a breaking change", {
 				examples: ["permdock diff main.catalog.json permissions.catalog.json", "permdock diff ./old-policy.ts ./src/policy.ts --impact"],
 				docs: "diff",
 				effects: [],
 				config: true,
-				load: async () => (await import("./diff-CmuSD3vc.js")).diff
+				load: async () => (await import("./diff-Btr1c1Ow.js")).diff
 			}),
 			leaf("config", "Check permdock.config.ts for unknown keys, or print the effective config", {
 				examples: ["permdock config", "permdock config --print"],
@@ -136,7 +136,7 @@ const SECTIONS = [
 				effects: [],
 				config: true,
 				findings: true,
-				load: async () => (await import("./config-Bj2Ixq3d.js")).config
+				load: async () => (await import("./config-DGZzMV1B.js")).config
 			})
 		]
 	},
@@ -153,14 +153,14 @@ const SECTIONS = [
 						"network"
 					],
 					config: true,
-					load: async () => (await import("./rls-BAqP4q66.js")).generate
+					load: async () => (await import("./rls-Ck_PocSp.js")).generate
 				}),
 				leaf("import", "Turn existing RLS policies into a generated definition", {
 					examples: ["permdock rls import --sql schema.sql --out src/permissions.generated.ts", "permdock rls import --db-url-stdin --out src/permissions.generated.ts"],
 					docs: "rls",
 					effects: ["files", "database:read"],
 					config: true,
-					load: async () => (await import("./rls-BAqP4q66.js")).importPolicies
+					load: async () => (await import("./rls-Ck_PocSp.js")).importPolicies
 				}),
 				leaf("verify", "Run the fixtures against the policies, or compare a live database", {
 					examples: [
@@ -169,16 +169,24 @@ const SECTIONS = [
 						"permdock rls verify --introspect --db-url-stdin"
 					],
 					docs: "rls",
-					effects: ["database:read"],
+					effects: ["files", "database:read"],
 					config: true,
-					load: async () => (await import("./rls-BAqP4q66.js")).verify
+					findings: true,
+					load: async () => (await import("./rls-Ck_PocSp.js")).verify
 				}),
 				leaf("migrate", "Rewrite hand-written policies onto the generated helpers", {
 					examples: ["permdock rls migrate --sql supabase/migrations --dry-run", "permdock rls migrate --sql supabase/migrations"],
 					docs: "rls",
 					effects: ["rewrite", "files"],
 					config: true,
-					load: async () => (await import("./rls-BAqP4q66.js")).migrate
+					load: async () => (await import("./rls-Ck_PocSp.js")).migrate
+				}),
+				leaf("explain", "Show the tables, membership sources and triggers the SQL binds to", {
+					examples: ["permdock rls explain", "permdock rls explain --db-url-stdin --json"],
+					docs: "rls",
+					effects: ["database:read"],
+					config: true,
+					load: async () => (await import("./rls-Ck_PocSp.js")).explain
 				})
 			]),
 			group("supabase", "Generate the Supabase Custom Access Token Hook, or inspect its manifest", "supabase", [group("hook", "The Custom Access Token Hook", "supabase", [leaf("generate", "Compile the membership sources into the hook migration", {
@@ -186,26 +194,37 @@ const SECTIONS = [
 				docs: "supabase",
 				effects: ["files", "database:read"],
 				config: true,
-				load: async () => (await import("./supabase-By_frk3U.js")).hookGenerate
+				load: async () => (await import("./supabase-Bqp7iIY2.js")).hookGenerate
 			})]), leaf("inspect", "Print or write the hook and helper manifest", {
 				examples: ["permdock supabase inspect", "permdock supabase inspect --out"],
 				docs: "supabase",
 				effects: ["files"],
 				config: true,
-				load: async () => (await import("./supabase-By_frk3U.js")).inspect
+				load: async () => (await import("./supabase-Bqp7iIY2.js")).inspect
 			})]),
 			group("powersync", "Generate PowerSync Sync Streams from the policy, or verify them", "powersync", [leaf("generate", "Compile the read grants into sync-config.yaml", {
 				examples: ["permdock powersync generate", "permdock powersync generate --check"],
 				docs: "powersync",
 				effects: ["files"],
 				config: true,
-				load: async () => (await import("./powersync-DISt6SUe.js")).generate
+				load: async () => (await import("./powersync-13odBwiM.js")).generate
 			}), leaf("verify", "Fail on stale streams or a stream that syncs a denied row", {
 				examples: ["permdock powersync verify", "permdock powersync verify --db-url-stdin"],
 				docs: "powersync",
 				effects: ["database:read"],
 				config: true,
-				load: async () => (await import("./powersync-DISt6SUe.js")).verify
+				load: async () => (await import("./powersync-13odBwiM.js")).verify
+			})]),
+			group("scim", "Generate the Postgres tables postgresDirectoryStore keeps a SCIM directory in", "scim", [leaf("generate", "Write the tenant-keyed users, groups and members tables", {
+				examples: [
+					"permdock scim generate",
+					"permdock scim generate --dialect guc --out db/scim.sql",
+					"permdock scim generate --check"
+				],
+				docs: "scim",
+				effects: ["files"],
+				config: true,
+				load: async () => (await import("./scim-C7JYhySg.js")).generate
 			})])
 		]
 	},
@@ -217,13 +236,13 @@ const SECTIONS = [
 				docs: "openapi",
 				effects: ["files"],
 				config: true,
-				load: async () => (await import("./openapi-C4dDTVEd.js")).emit
+				load: async () => (await import("./openapi-DMocl1bh.js")).emit
 			}), leaf("import", "Turn an OpenAPI document into a generated definition", {
 				examples: ["permdock openapi import --doc openapi.yaml --out src/permissions.generated.ts"],
 				docs: "openapi",
 				effects: ["files", "network"],
 				config: false,
-				load: async () => (await import("./openapi-C4dDTVEd.js")).importDocument
+				load: async () => (await import("./openapi-DMocl1bh.js")).importDocument
 			})]),
 			group("arazzo", "Check Arazzo workflows against the permissions", "arazzo", [leaf("check", "Resolve every Arazzo step to x-permdock-permissions", {
 				examples: ["permdock arazzo check --doc arazzo.json --openapi openapi.json"],
@@ -231,7 +250,7 @@ const SECTIONS = [
 				effects: [],
 				config: true,
 				findings: true,
-				load: async () => (await import("./arazzo-41WuzHou.js")).check
+				load: async () => (await import("./arazzo-ClrF3PVb.js")).check
 			})]),
 			leaf("scan", "List authorization checks written without PermDock, to adopt it in an existing app", {
 				examples: ["permdock scan", "permdock scan --src app,lib --pattern isBeta"],
@@ -239,21 +258,21 @@ const SECTIONS = [
 				effects: [],
 				config: true,
 				findings: true,
-				load: async () => (await import("./scan-qvOe0hS3.js")).scan
+				load: async () => (await import("./scan-DSljDE1Y.js")).scan
 			}),
 			group("casl", "Import CASL rules into a generated module", "casl", [leaf("import", "Turn CASL rules per role into a permissions and policy module", {
 				examples: ["permdock casl import --rules rules.json --out src/permissions.generated.ts"],
 				docs: "casl",
 				effects: ["files"],
 				config: false,
-				load: async () => (await import("./casl-64gpT-8x.js")).caslImport
+				load: async () => (await import("./casl-CmJlgziS.js")).caslImport
 			})]),
 			group("casbin", "Import a Casbin model and policy into a generated module", "casbin", [leaf("import", "Turn a Casbin RBAC model and policy into a permissions and policy module", {
 				examples: ["permdock casbin import --model model.conf --policy policy.csv --out src/permissions.generated.ts"],
 				docs: "casbin",
 				effects: ["files"],
 				config: false,
-				load: async () => (await import("./casbin-Cr7RLtA3.js")).casbinImport
+				load: async () => (await import("./casbin-BHijLuHY.js")).casbinImport
 			})])
 		]
 	},
@@ -265,34 +284,34 @@ const SECTIONS = [
 				docs: "login",
 				effects: ["network", "files"],
 				config: false,
-				load: async () => (await import("./login-Dfe5RlYk.js")).login
+				load: async () => (await import("./login-ClSJh5t5.js")).login
 			}),
 			leaf("logout", "Revoke and delete the stored PermDock Cloud login", {
 				examples: ["permdock logout"],
 				docs: "login",
 				effects: ["network", "files"],
 				config: false,
-				load: async () => (await import("./login-Dfe5RlYk.js")).logout
+				load: async () => (await import("./login-ClSJh5t5.js")).logout
 			}),
 			leaf("whoami", "Print the PermDock Cloud identity the CLI acts as", {
 				examples: ["permdock whoami", "permdock whoami --json"],
 				docs: "login",
 				effects: [],
 				config: false,
-				load: async () => (await import("./login-Dfe5RlYk.js")).whoami
+				load: async () => (await import("./login-ClSJh5t5.js")).whoami
 			}),
 			group("cloud", "Publish to or pull from a PermDock Cloud project", "cloud", [leaf("push", "Publish the catalog, policy and manifest to a Cloud project", {
 				examples: ["permdock cloud push --dry-run", "permdock cloud push --project prj_123"],
 				docs: "cloud",
 				effects: ["network", "cloud:write"],
 				config: true,
-				load: async () => (await import("./cloud-ytQ3uviA.js")).push
+				load: async () => (await import("./cloud-CO8pYtwr.js")).push
 			}), leaf("pull", "Write a Cloud project's published catalog and manifest", {
 				examples: ["permdock cloud pull --project prj_123"],
 				docs: "cloud",
 				effects: ["network", "files"],
 				config: true,
-				load: async () => (await import("./cloud-ytQ3uviA.js")).pull
+				load: async () => (await import("./cloud-CO8pYtwr.js")).pull
 			})])
 		]
 	},
@@ -303,7 +322,7 @@ const SECTIONS = [
 			docs: "codemod",
 			effects: ["rewrite"],
 			config: false,
-			load: async () => (await import("./codemod-5mpSpnUY.js")).codemod
+			load: async () => (await import("./codemod-i4N2BhDc.js")).codemod
 		})]
 	}
 ];
@@ -315,7 +334,7 @@ const COMPLETE_LEAF = leaf("__complete", "Print completion candidates for a part
 	config: false,
 	shellOutput: true,
 	hidden: true,
-	load: async () => (await import("./completion-BTFrHZhX.js")).complete
+	load: async () => (await import("./completion-BNdVf7X2.js")).complete
 });
 const ROOT = group("permdock", "Collect, export, diff and check the permissions a PermDock policy declares", "", [...SECTIONS.flatMap((section) => section.entries), COMPLETE_LEAF]);
 /** Each leaf with its path from the root, in manifest order. */

package/dist/{manifest-schema-C0kK_8V0.js → manifest-schema-Cv492Qev.js}

@@ -10,13 +10,8 @@ const supabaseManifestSchema = freezeDeep({
 	required: [
 		"$schema",
 		"version",
-		"hook",
 		"helpers",
 		"tenantClaim",
-		"budget",
-		"claims",
-		"authzVersion",
-		"memberships",
 		"rls",
 		"decidingColumns",
 		"markers"
@@ -95,6 +90,24 @@ const supabaseManifestSchema = freezeDeep({
 			}
 		},
 		authzVersion: { type: "boolean" },
+		managementApi: {
+			description: "The Management API fields that make a hosted project call the generated hook, as `permdock supabase inspect` prints and `--out` writes them.",
+			type: "object",
+			required: [
+				"hook_custom_access_token_enabled",
+				"hook_custom_access_token_uri",
+				"jwt_exp"
+			],
+			properties: {
+				hook_custom_access_token_enabled: { const: true },
+				hook_custom_access_token_uri: { type: "string" },
+				jwt_exp: {
+					description: "The access token lifetime in seconds: `[auth] jwt_expiry` of `supabase/config.toml`, or 3600 when it is unset.",
+					type: "integer"
+				}
+			},
+			additionalProperties: false
+		},
 		authzVersionBump: {
 			type: "object",
 			required: [
@@ -222,6 +235,7 @@ const supabaseManifestSchema = freezeDeep({
 						items: { type: "string" }
 					} }
 				},
+				tokenScopes: { type: "boolean" },
 				apiKeys: {
 					type: "object",
 					required: [
@@ -349,7 +363,7 @@ const supabaseManifestSchema = freezeDeep({
 		},
 		helperName: {
 			type: "string",
-			pattern: "^(permdock_has(_for)?|permitted_[a-z][a-z0-9_]*_(ids|permission_keys)(_for)?|permitted_[a-z][a-z0-9_]*_users|member_[a-z][a-z0-9_]*_ids(_for)?|permdock_can_assign(_any|_custom_role)?(_for)?|permdock_api_key_allows|permdock_actor_may_write|permdock_is_approver|permdock_user_id)$"
+			pattern: "^(permdock_has(_for)?|permitted_[a-z][a-z0-9_]*_(ids|permission_keys)(_for)?|permitted_[a-z][a-z0-9_]*_users|member_[a-z][a-z0-9_]*_ids(_for)?|permdock_can_assign(_any|_custom_role)?(_for)?|permdock_api_key_allows|permdock_token_scope_allows|permdock_actor_may_write|permdock_is_approver|permdock_user_id)$"
 		},
 		column: {
 			type: "object",
@@ -357,7 +371,23 @@ const supabaseManifestSchema = freezeDeep({
 			additionalProperties: false,
 			properties: { column: { $ref: "#/$defs/identifier" } }
 		},
-		role: { oneOf: [{ $ref: "#/$defs/value" }, { $ref: "#/$defs/through" }] },
+		role: { oneOf: [
+			{ $ref: "#/$defs/value" },
+			{ $ref: "#/$defs/through" },
+			{ $ref: "#/$defs/mapped" }
+		] },
+		mapped: {
+			type: "object",
+			required: ["column", "map"],
+			additionalProperties: false,
+			properties: {
+				column: { $ref: "#/$defs/identifier" },
+				map: {
+					type: "object",
+					additionalProperties: { type: ["string", "null"] }
+				}
+			}
+		},
 		user: { oneOf: [{ $ref: "#/$defs/column" }, { $ref: "#/$defs/through" }] },
 		through: {
 			type: "object",

package/dist/{map-claims-D3oRmTk0.js → map-claims-etGIS_Dv.js}

@@ -338,19 +338,22 @@ function mapClaimsToSubject(claims, options) {
 		invalidChain: false
 	};
 }
+/** `true` when a verified token is not an OpenID Connect ID token for one of `clients`. */
+function idTokenMismatch(claims, headerTyp, clients) {
+	const typ = headerTyp?.toLowerCase();
+	if (typ !== void 0 && typ !== "jwt" && typ !== "application/jwt") return true;
+	if (typeof claims.iat !== "number") return true;
+	const aud = claims.aud;
+	const audiences = Array.isArray(aud) ? aud : aud === void 0 ? [] : [aud];
+	const expected = clients === void 0 ? [] : typeof clients === "string" ? [clients] : clients;
+	const azp = claims["azp"];
+	if (azp === void 0) return audiences.length > 1;
+	return typeof azp !== "string" || !expected.includes(azp);
+}
 function acceptMismatch(claims, headerTyp, options, audience) {
 	const accept = options.accept ?? "access-token";
 	const typ = headerTyp?.toLowerCase();
-	if (accept === "id-token") {
-		if (typ !== void 0 && typ !== "jwt" && typ !== "application/jwt") return true;
-		if (typeof claims.iat !== "number") return true;
-		const aud = claims.aud;
-		const audiences = Array.isArray(aud) ? aud : aud === void 0 ? [] : [aud];
-		const clients = audience === void 0 ? [] : typeof audience === "string" ? [audience] : audience;
-		const azp = claims["azp"];
-		if (azp === void 0) return audiences.length > 1;
-		return typeof azp !== "string" || !clients.includes(azp);
-	}
+	if (accept === "id-token") return idTokenMismatch(claims, headerTyp, audience);
 	if (options.profile === "fapi2" && typ !== "at+jwt") return true;
 	if (typeof claims["nonce"] === "string") return true;
 	if (audience !== void 0 && typeof claims.aud === "string") {
@@ -360,4 +363,4 @@ function acceptMismatch(claims, headerTyp, options, audience) {
 	return false;
 }
 //#endregion
-export { mapClaimsToSubject as n, validateCustomClaims as r, acceptMismatch as t };
+export { validateCustomClaims as i, idTokenMismatch as n, mapClaimsToSubject as r, acceptMismatch as t };

package/dist/{map-error-Dr70oA_3.js → map-error-BQGyDm_M.js}

@@ -2,7 +2,7 @@ import { t as compact } from "./compact-CAf557ZB.js";
 import { n as PermDockValidationError } from "./validation-error-ZfUHbKvf.js";
 import { n as PermDockDeniedError, r as PermDockRevokedError, t as PermDockApprovalRequiredError } from "./errors-BKy0EfhN.js";
 import { c as problemResponse, i as decisionResponse } from "./problem-CTviyH5L.js";
-import { u as InvalidSignatureError } from "./evaluations-beAooV0n.js";
+import { l as InvalidSignatureError } from "./evaluations-DReoiVBw.js";
 //#region src/server/map-error.ts
 /**
 * Turns a thrown PermDock error into its Problem Details response, with the

package/dist/mcp/index.d.ts

@@ -1,14 +1,14 @@
-import { $n as Delegation, T as Policy, ar as Subject, rr as Principal } from "../policy-types-n0uRTsW8.js";
-import { w as Permission } from "../vocabulary-CN8H_9UF.js";
-import { m as ApprovalStore } from "../types-BdtSDbBO.js";
-import { t as ApprovalHint } from "../errors-DH5QEGXh.js";
-import { t as InstanceOptions } from "../instance-options-BsVpyGIk.js";
+import { T as Policy, Y as JwtClaims, dt as TokenVerifier, lr as Subject, rr as Delegation, sr as Principal } from "../policy-types-B-F-qAZk.js";
+import { u as Permission } from "../permission-types-DhNEmoRG.js";
+import { m as ApprovalStore } from "../types-DC44-hqb.js";
+import { t as ApprovalHint } from "../errors-B_Qg9D3e.js";
+import { t as InstanceOptions } from "../instance-options-CU0YQCLH.js";
 import { t as RequestContext } from "../request-context-C2_1lchh.js";
-import { n as PermDockWrap } from "../wrap-C5jC6sKI.js";
-import { o as OtelWrap } from "../types-lUlG3TVd.js";
-import { n as DeniedTextEvent, t as DeniedText } from "../denied-text-CiFQNuMV.js";
+import { n as PermDockWrap } from "../wrap-B6R0cMRL.js";
+import { o as OtelWrap } from "../types-CIeZcG8v.js";
+import { n as DeniedTextEvent, t as DeniedText } from "../denied-text-D4qkEtFz.js";
 import { t as ClientNames } from "../clients-C7zLFuWT.js";
-import { U as JwtSubjectOptions } from "../types-C791HFu9.js";
+import { U as JwtSubjectOptions } from "../types-cTos-H7p.js";
 import { CacheHint, Icon, McpServer, PromptCallback, ReadResourceCallback, ReadResourceTemplateCallback, RegisteredPrompt, RegisteredResource, RegisteredResourceTemplate, RegisteredTool, ResourceMetadata, ResourceTemplate, ScopeChallengeHandler, StandardSchemaWithJSON, ToolAnnotations, ToolCallback, Variables } from "@modelcontextprotocol/server";
 //#region src/mcp/types.d.ts
 /** The verified `AuthInfo` the MCP SDK's bearer auth puts on `ctx.http.authInfo`. */
@@ -54,6 +54,13 @@ type McpResourceConfig<TArgs extends readonly unknown[]> = Guard<TArgs> & Resour
   readonly cacheHint?: CacheHint;
   readonly scopeChallenge?: ScopeChallengeHandler;
 };
+/**
+ * An MCP Apps view (`ui://`). Without `permission` it takes the permission of
+ * the tool whose `_meta.ui.resourceUri` names it, and denies while no tool does.
+ */
+type McpUiResourceConfig = Omit<McpResourceConfig<[uri: URL]>, "permission"> & {
+  readonly permission?: Permission;
+};
 type McpPromptConfig<TArgs extends StandardSchemaWithJSON | undefined = undefined> = Guard<[args: InputOf<TArgs>]> & {
   readonly title?: string;
   readonly description?: string;
@@ -65,6 +72,7 @@ type McpPromptConfig<TArgs extends StandardSchemaWithJSON | undefined = undefine
 /** `McpServer` whose `register*` methods take a `permission` and decide first. */
 type GuardedMcpServer = Omit<McpServer, "registerTool" | "registerResource" | "registerPrompt"> & {
   registerTool<TInput extends StandardSchemaWithJSON | undefined = undefined, TOutput extends StandardSchemaWithJSON | undefined = undefined>(name: string, config: McpToolConfig<TInput, TOutput>, handler: ToolCallback<TInput>): RegisteredTool;
+  registerResource(name: string, uri: `ui://${string}`, config: McpUiResourceConfig, read: ReadResourceCallback): RegisteredResource;
   registerResource(name: string, uri: string, config: McpResourceConfig<[uri: URL]>, read: ReadResourceCallback): RegisteredResource;
   registerResource(name: string, template: ResourceTemplate, config: McpResourceConfig<[uri: URL, variables: Variables]>, read: ReadResourceTemplateCallback): RegisteredResourceTemplate;
   registerPrompt<TArgs extends StandardSchemaWithJSON | undefined = undefined>(name: string, config: McpPromptConfig<TArgs>, handler: PromptCallback<TArgs>): RegisteredPrompt;
@@ -166,6 +174,52 @@ export declare function createPermDock<TUser, TPrincipal extends Principal = Pri
 /** `_meta` key on `tools/call`, `resources/read` and `prompts/get` carrying an approval token. */
 export declare const APPROVAL_META_KEY = "dev.permdock/approval";
 //#endregion
+//#region src/mcp/resource-guard.d.ts
+type McpResourceGuardOptions = {
+  /** The MCP server's resource identifier (RFC 8707); a token's `aud` must contain it. */
+  readonly resource: string | URL;
+  /** Scopes every request needs; a token without one of them gets `403 insufficient_scope`. */
+  readonly scopes?: readonly string[];
+  readonly verifier: TokenVerifier;
+  /** The authorization server's issuer, when the verifier does not check `iss` itself. */
+  readonly issuer?: string;
+  /** `true` for a revoked token; a throw also refuses it. */
+  readonly revoked?: (claims: JwtClaims) => boolean | Promise<boolean>;
+  /** The RFC 9728 metadata URL in challenges; default `<origin>/.well-known/oauth-protected-resource<path>`. */
+  readonly resourceMetadataUrl?: string;
+};
+type McpResourceGuardResult = {
+  readonly ok: true;
+  readonly authInfo: McpAuthInfo;
+} | {
+  readonly ok: false;
+  readonly response: Response;
+};
+type ProtectedResourceMetadataOptions = {
+  readonly resource: string | URL;
+  /** `authorization_servers`: the issuers whose tokens the resource accepts. */
+  readonly authorizationServers: readonly string[];
+  /** `scopes_supported`; list every permission's `scope` so clients can ask for them up front. */
+  readonly scopesSupported?: readonly string[];
+  readonly resourceName?: string;
+  readonly resourceDocumentation?: string;
+};
+/**
+ * The resource-server check in front of an MCP endpoint (MCP authorization,
+ * RFC 6750, RFC 9728): reads the bearer token from `Authorization`, verifies
+ * it for `resource`, refuses a revoked one and checks `scopes`. It answers
+ * the `McpAuthInfo` the SDK's handlers read, or the `401` or `403` response
+ * with a `WWW-Authenticate` challenge naming the metadata URL. A token in the
+ * query string is never read. Never throws.
+ */
+export declare function mcpResourceGuard(options: McpResourceGuardOptions): (request: Request) => Promise<McpResourceGuardResult>;
+/**
+ * The RFC 9728 Protected Resource Metadata document as a Fetch handler, for
+ * `/.well-known/oauth-protected-resource<path>`. `bearer_methods_supported`
+ * is `header`, the only method `mcpResourceGuard` reads. Any origin may read it.
+ */
+export declare function protectedResourceMetadata(options: ProtectedResourceMetadataOptions): (request: Request) => Response;
+//#endregion
 //#region src/mcp/subject.d.ts
 type McpSubjectOptions = Pick<JwtSubjectOptions, "claims" | "groupRoles" | "schema" | "delegation"> & {
   /** The `kind` of the actor built from `authInfo.clientId`; `'mcp-client'` when absent. Match `createPermDock`'s `actorKind`. */
@@ -183,4 +237,4 @@ type McpSubjectOptions = Pick<JwtSubjectOptions, "claims" | "groupRoles" | "sche
  */
 export declare function subjectFromMcp(authInfo: McpAuthInfo | undefined, options?: McpSubjectOptions): Subject<McpPrincipal>;
 //#endregion
-export type { DeniedText, DeniedTextEvent, GuardedMcpServer, McpAuthInfo, McpPermDock, McpPermDockOptions, McpPrincipal, McpProcedureEnforcement, McpProcedureToolConfig, McpPromptConfig, McpResourceConfig, McpSubjectOptions, McpToolConfig, ProcedureMcpServer };
+export type { DeniedText, DeniedTextEvent, GuardedMcpServer, McpAuthInfo, McpPermDock, McpPermDockOptions, McpPrincipal, McpProcedureEnforcement, McpProcedureToolConfig, McpPromptConfig, McpResourceConfig, McpResourceGuardOptions, McpResourceGuardResult, McpSubjectOptions, McpToolConfig, McpUiResourceConfig, ProcedureMcpServer, ProtectedResourceMetadataOptions };