permdock 0.7.0 → 0.8.0

package/dist/mcp/index.js

@@ -1,27 +1,33 @@
 import { r as isRecord, t as compact } from "../compact-CAf557ZB.js";
-import { n as freezeDeep } from "../freeze-CrU8nQeX.js";
-import { i as stepUpOf, o as statusProblem } from "../problem-details-cn5X30gZ.js";
-import { t as describe } from "../describe-DZlnEtLy.js";
-import { m as annotationsFor } from "../permission-registry-DpPtSKNZ.js";
-import { t as actorMayCallTool } from "../delegation-C5rOdTp5.js";
+import { n as freezeDeep } from "../freeze-jjan0lCv.js";
+import { i as stepUpOf, o as statusProblem } from "../problem-details-CLDgX1KV.js";
+import { n as describe } from "../describe-Bb4hGK5d.js";
+import { m as annotationsFor } from "../permission-registry-B8tYxPIt.js";
+import { t as actorMayCallTool } from "../delegation-CDB6_keF.js";
 import { n as resourceRef } from "../resource-ref-CaS9yVPi.js";
-import { i as challengeScope, l as withApp, o as hasScope, s as scopesReaching } from "../permdock-BfWEeMqk.js";
+import { i as challengeScope, l as withApp, o as hasScope, s as scopesReaching } from "../permdock-L-_I_3zP.js";
 import { t as anonymousSubject } from "../subject-BGoM5o8B.js";
-import { t as composeWraps } from "../wrap-CiSc_KCq.js";
-import { a as methodNotAllowed, c as problemResponse, l as protectedResourceMetadataUrl, r as bearerChallenge } from "../problem-CTviyH5L.js";
-import { t as clientNameOf } from "../clients-DjU5ABMy.js";
-import { r as mapClaimsToSubject } from "../map-claims-etGIS_Dv.js";
-import { r as instanceOptions } from "../build-instance-DxE7czo9.js";
-import { i as refusalText, n as createAgentKernel } from "../kernel-DVExUwkp.js";
+import { t as composeWraps } from "../wrap-B2wziJI_.js";
+import { l as problemResponse, o as methodNotAllowed, r as bearerChallenge, u as protectedResourceMetadataUrl } from "../problem-BVLHFK33.js";
+import { t as clientNameOf } from "../clients-DYr3U86j.js";
+import { r as mapClaimsToSubject } from "../map-claims-BNWCJtmP.js";
+import { r as instanceOptions } from "../build-instance-CNWaYJyr.js";
+import { i as refusalText, n as createAgentKernel } from "../kernel-C-fYydV2.js";
 import { t as boundedMap } from "../lru-8q4WZjBV.js";
 import { t as delegationFrom } from "../delegation-input-FTxMK3ji.js";
-import { n as deniedToolRefusal, r as toolErrorResult, t as approvalToolRefusal } from "../tool-refusal-reAhIzdl.js";
+import { n as deniedToolRefusal, r as toolErrorResult, t as approvalToolRefusal } from "../tool-refusal-Qpjs_W6M.js";
 //#region src/mcp/mcp-auth.ts
-/** `_meta` key on `tools/call`, `resources/read` and `prompts/get` carrying an approval token. */
+/**
+* `_meta` key on `tools/call`, `resources/read` and `prompts/get` carrying an
+* approval token.
+*/
 const APPROVAL_META_KEY = "dev.permdock/approval";
 const CLIENT_CAPABILITIES = "io.modelcontextprotocol/clientCapabilities";
 const PROTOCOL_VERSION = "io.modelcontextprotocol/protocolVersion";
-/** The first protocol revision whose list results define `ttlMs` and `cacheScope`. */
+/**
+* The first protocol revision whose list results define `ttlMs` and
+* `cacheScope`.
+*/
 const CACHEABLE_LISTS_SINCE = "2026-07-28";
 function contextOf(value) {
 	return isRecord(value) ? value : {};
@@ -54,8 +60,8 @@ function sameResource(expected, actual) {
 }
 /**
 * Whether the request was sent under a revision that defines `cacheScope` on
-* list results. Only those requests carry the per-request envelope; a
-* 2025-era request has none and gets no cache fields.
+* list results. Only those requests carry the per-request envelope; a 2025-era
+* request has none and gets no cache fields.
 */
 function definesCacheScope(context) {
 	const version = context.mcpReq?.envelope?.[PROTOCOL_VERSION];
@@ -165,7 +171,10 @@ function throwRefusal(refusal) {
 	if (refusal.inputRequired !== void 0) return refusal.inputRequired;
 	throw new Error(refusal.text);
 }
-/** The MRTR URL elicitation that sends the user to `options.approval.at`, when the client accepts one. */
+/**
+* The MRTR URL elicitation that sends the user to `options.approval.at`, when
+* the client accepts one.
+*/
 async function approvalInput(options, decision, handlerContext, context, capabilities) {
 	const at = options.approval?.at;
 	if (at === void 0 || !acceptsUrlElicitation(context, capabilities)) return;
@@ -174,7 +183,10 @@ async function approvalInput(options, decision, handlerContext, context, capabil
 	const requestState = options.requestState === void 0 ? decision.token : await options.requestState.mint(decision.token, handlerContext);
 	return urlElicitation("approval", options.approval?.hint ?? describe(decision).detail, url, requestState);
 }
-/** A step-up denial: the RFC 9470 challenge, and a URL elicitation to `stepUpAt` when the client accepts one. */
+/**
+* A step-up denial: the RFC 9470 challenge, and a URL elicitation to `stepUpAt`
+* when the client accepts one.
+*/
 function stepUpRefusal(stepUpAt, decision, permission, data, context, capabilities) {
 	const base = deniedRefusal(decision, permission, data);
 	const { acrValues, maxAge } = stepUpOf(decision);
@@ -215,7 +227,10 @@ function forThisServer(checks, authInfo) {
 function reachable(checks, authInfo, reach) {
 	return authInfo === void 0 ? checks.options.requireAuthInfo !== true : forThisServer(checks, authInfo) && hasScope(authInfo.scopes, reach.scopes);
 }
-/** The refusal a token earns before any decision: none, the wrong resource, or a missing scope. */
+/**
+* The refusal a token earns before any decision: none, the wrong resource, or a
+* missing scope.
+*/
 function credentialRefusal(checks, permission, reach, authInfo) {
 	if (authInfo === void 0) return checks.options.requireAuthInfo === true ? plainRefusal(permission, "Denied: no verified credentials.", { error: "invalid_token" }) : void 0;
 	if (!forThisServer(checks, authInfo)) return plainRefusal(permission, "Denied: the token was not issued for this server.", { error: "invalid_token" });
@@ -233,7 +248,10 @@ function credentialRefusal(checks, permission, reach, authInfo) {
 		}))
 	}));
 }
-/** The completion re-check of a long-running tool: the call must still be allowed, or approved with the same token. */
+/**
+* The completion re-check of a long-running tool: the call must still be
+* allowed, or approved with the same token.
+*/
 async function recheck(checks, binding, args, call, permission, approved, tool) {
 	const rechecked = await checks.kernel.check(binding, args, call, compact({
 		simulate: true,
@@ -328,8 +346,9 @@ async function checkCall(checks, permission, reach, args, load, context, handler
 	};
 }
 /**
-* The keys a list shows: unguarded ones, and guarded ones the token reaches and the subject may use.
-* With `tools`, a guarded key is also a tool name an `agent` actor's `tools` list must name.
+* The keys a list shows: unguarded ones, and guarded ones the token reaches and
+* the subject may use. With `tools`, a guarded key is also a tool name an
+* `agent` actor's `tools` list must name.
 */
 async function visible(checks, context, permissionOf, keys, declaredOf = () => void 0, tools = false) {
 	const authInfo = context.http?.authInfo;
@@ -485,7 +504,10 @@ function protectServer(checks, server, enforcement) {
 		for (const field of ["data", "longRunning"]) if (config[field] !== void 0) throw new TypeError(`permdock/mcp: tool ${name} sets ${field}, but with enforce: 'procedure' its procedure decides.`);
 		return requirePermission("tool", name, { permission: enforcement.permissionFor(name) });
 	};
-	/** With `enforce: 'procedure'` the handler runs undecided: the procedure it calls decides. */
+	/**
+	* With `enforce: 'procedure'` the handler runs undecided: the procedure it
+	* calls decides.
+	*/
 	const wrapTool = (tool, permission, reach, load, handler, longRunning) => enforcement === void 0 ? guardTool(tool, permission, reach, load, handler, longRunning) : async (...params) => {
 		const result = await handler(...params);
 		await announce(contextOf(params.at(-1)));
@@ -545,7 +567,10 @@ function protectServer(checks, server, enforcement) {
 	const originalResource = server.registerResource.bind(server);
 	const registerResource = (name, uriOrTemplate, config, read) => {
 		const own = config["permission"] === void 0 && typeof uriOrTemplate === "string" && uriOrTemplate.startsWith(UI_SCHEME) ? void 0 : requirePermission("resource", name, config);
-		/** A `ui://` view without its own permission takes the one of the tool linking it; unlinked, it denies. */
+		/**
+		* A `ui://` view without its own permission takes the one of the tool
+		* linking it; unlinked, it denies.
+		*/
 		const permissionNow = () => own ?? (typeof uriOrTemplate === "string" ? uiLinks.get(uriOrTemplate)?.permission : void 0);
 		const { permission: _permission, data, scopeChallenge, ...passthrough } = config;
 		const load = data;
@@ -581,18 +606,20 @@ function protectServer(checks, server, enforcement) {
 //#endregion
 //#region src/mcp/subject.ts
 const DEFAULT_MCP_ACTOR_KIND = "mcp-client";
-/** `kind`, or the default when absent; `undefined` for a kind that is not a non-empty string. */
+/**
+* `kind`, or the default when absent; `undefined` for a kind that is not a
+* non-empty string.
+*/
 function mcpActorKind(kind) {
 	if (kind === void 0) return DEFAULT_MCP_ACTOR_KIND;
 	return typeof kind === "string" && kind !== "" ? kind : void 0;
 }
 /**
 * Maps the `AuthInfo` the MCP SDK's bearer verification produced to a
-* `Subject`: the principal from the verified claims in `extra`, the client
-* as an actor of kind `actorKind` (`mcp-client` by default), the granted
-* scopes as the delegation. Never verifies and never throws; anything
-* unusable, including an `actorKind` that is not a non-empty string, is
-* the anonymous subject.
+* `Subject`: the principal from the verified claims in `extra`, the client as
+* an actor of kind `actorKind` (`mcp-client` by default), the granted scopes as
+* the delegation. Never verifies and never throws; anything unusable, including
+* an `actorKind` that is not a non-empty string, is the anonymous subject.
 */
 function subjectFromMcp(authInfo, options = {}) {
 	try {
@@ -657,7 +684,10 @@ function createPermDock(policy, given) {
 }
 //#endregion
 //#region src/mcp/resource-guard.ts
-/** The `error_description` of every `invalid_token` challenge (RFC 6750 section 3.1). */
+/**
+* The `error_description` of every `invalid_token` challenge (RFC 6750 section
+* 3.1).
+*/
 const INVALID_TOKEN = "The access token is invalid";
 const BEARER = /^Bearer +([\w~+/.-]+=*)$/iu;
 function tokenScopes(claims) {
@@ -672,12 +702,12 @@ function refuse(status, challenge, detail) {
 	};
 }
 /**
-* The resource-server check in front of an MCP endpoint (MCP authorization,
-* RFC 6750, RFC 9728): reads the bearer token from `Authorization`, verifies
-* it for `resource`, refuses a revoked one and checks `scopes`. It answers
-* the `McpAuthInfo` the SDK's handlers read, or the `401` or `403` response
-* with a `WWW-Authenticate` challenge naming the metadata URL. A token in the
-* query string is never read. Never throws.
+* The resource-server check in front of an MCP endpoint (MCP authorization, RFC
+* 6750, RFC 9728): reads the bearer token from `Authorization`, verifies it for
+* `resource`, refuses a revoked one and checks `scopes`. It answers the
+* `McpAuthInfo` the SDK's handlers read, or the `401` or `403` response with a
+* `WWW-Authenticate` challenge naming the metadata URL. A token in the query
+* string is never read. Never throws.
 */
 function mcpResourceGuard(options) {
 	const resource = new URL(String(options.resource));
@@ -728,8 +758,8 @@ function mcpResourceGuard(options) {
 }
 /**
 * The RFC 9728 Protected Resource Metadata document as a Fetch handler, for
-* `/.well-known/oauth-protected-resource<path>`. `bearer_methods_supported`
-* is `header`, the only method `mcpResourceGuard` reads. Any origin may read it.
+* `/.well-known/oauth-protected-resource<path>`. `bearer_methods_supported` is
+* `header`, the only method `mcpResourceGuard` reads. Any origin may read it.
 */
 function protectedResourceMetadata(options) {
 	const body = JSON.stringify(compact({

package/dist/{migrate-Dodel0IJ.js → migrate-B7oP_sQU.js}

@@ -1,15 +1,15 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
-import { i as dateAt } from "./time-DkWjdL98.js";
-import { a as describeError } from "./errors-DpP_U6Bf.js";
-import { o as sqlFiles } from "./files-D_JIzUrP.js";
-import { r as escapeSqlIdent, s as quoteSqlLiteral } from "./sql-B96movIM.js";
-import "./sources-B-zYB4GS.js";
-import { a as RETIRE_MARKER } from "./markers-C6joDI3o.js";
-import { r as refuseDirty, t as applyFiles } from "./files-acUbNwWt.js";
-import { f as writeOutputFiles, n as dataMigrationFile } from "./output-files-CCMdcFWb.js";
-import { r as HELPERS } from "./shared-fMKOv8hP.js";
-import { o as sqlStatements } from "./deciding-columns-DRo2QM6E.js";
-import { i as retireSql, r as retirePlan } from "./retire-Wj6dkyDE.js";
+import { i as dateAt } from "./time-nR1JesoH.js";
+import { a as describeError } from "./errors-Vpu6rKHl.js";
+import { o as sqlFiles } from "./files-BSjrtIHw.js";
+import { r as escapeSqlIdent, s as quoteSqlLiteral } from "./sql-0WjxIp9g.js";
+import "./sources-CMAM-2A3.js";
+import { a as RETIRE_MARKER } from "./markers-BeHZ4x9Q.js";
+import { i as refuseDirty, t as applyFiles } from "./files-B3AA05f1.js";
+import { f as writeOutputFiles, n as dataMigrationFile } from "./output-files-BIQ_9pIs.js";
+import { r as HELPERS } from "./shared-Afctg7B0.js";
+import { o as sqlStatements } from "./deciding-columns-NB4wcyBf.js";
+import { i as retireSql, r as retirePlan } from "./retire-B2xffQgY.js";
 import { existsSync, readFileSync } from "node:fs";
 import { relative, resolve } from "node:path";
 import { parse } from "pgsql-parser";
@@ -84,7 +84,10 @@ function callEnd(text, start) {
 	}
 	return -1;
 }
-/** The top-level arguments of the call at `start`, as written; `end` is past its closing paren. */
+/**
+* The top-level arguments of the call at `start`, as written; `end` is past its
+* closing paren.
+*/
 function argTexts(text, start, end) {
 	const open = text.indexOf("(", start);
 	const args = [];
@@ -129,7 +132,10 @@ function isNullConst(node) {
 	return child(child(node, "A_Const"), "isnull") === true;
 }
 const literal = quoteSqlLiteral;
-/** The PermDock key for a legacy one: `keys` first, then `renamed`, then the longest matching prefix. */
+/**
+* The PermDock key for a legacy one: `keys` first, then `renamed`, then the
+* longest matching prefix.
+*/
 function mapKey(config, key, renamed = {}) {
 	const exact = config.keys?.[key];
 	if (exact !== void 0) return exact;
@@ -228,7 +234,10 @@ var Rewriter = class {
 		if (this.#config.globalScopes?.includes(named) === true || isNullConst(idArg)) return this.#global(keyArg, selected);
 		return this.#row(this.#config.scopes?.[named] ?? named, idArg, keyArg, 1);
 	}
-	/** `selected`: the call is already a `select` target, so `permdock_has` needs no wrapping subquery. */
+	/**
+	* `selected`: the call is already a `select` target, so `permdock_has` needs
+	* no wrapping subquery.
+	*/
 	rewrite(call, selected) {
 		const { helper, args } = call;
 		this.#args = argTexts(this.#text, call.start, call.end);
@@ -275,7 +284,10 @@ function bodyStrings(statement) {
 	}
 	return found;
 }
-/** What `call`, written inside a function body, becomes: the rewrite that its place keeps from being applied. */
+/**
+* What `call`, written inside a function body, becomes: the rewrite that its
+* place keeps from being applied.
+*/
 async function suggest(call, config, target) {
 	const sql = `select ${call}`;
 	let tree;
@@ -293,7 +305,10 @@ async function suggest(call, config, target) {
 	const outcome = rewriter.rewrite(found, true);
 	return "to" in outcome ? outcome.to : void 0;
 }
-/** Rewrites the configured helper calls in one file's policies; everything else is reported. */
+/**
+* Rewrites the configured helper calls in one file's policies; everything else
+* is reported.
+*/
 async function migrateSql(file, text, config, target) {
 	const rewrites = [];
 	const skipped = [];
@@ -418,7 +433,10 @@ function describe(report, write) {
 	lines.push(`rls migrate: ${write ? "rewrote" : "would rewrite"} ${String(report.rewrites.length)} call(s) in ${String(files)} file(s), skipped ${String(report.skipped.length)}${unknown === 0 ? "" : `, ${String(unknown)} with an unknown key`}${write ? "" : "; drop --dry-run to apply them"}`);
 	return lines.join("\n");
 }
-/** `permdock rls migrate`: a dry run unless `write`; exits 1 while a key is unknown. */
+/**
+* `permdock rls migrate`: a dry run unless `write`; exits 1 while a key is
+* unknown.
+*/
 async function runRlsMigrate(input) {
 	const root = resolve(input.cwd, input.sql);
 	if (!existsSync(root)) return {

package/dist/module-values-BJTBdo6y.js

@@ -0,0 +1,107 @@
+import { c as listPermissions } from "./permission-registry-B8tYxPIt.js";
+import { i as configError } from "./errors-Vpu6rKHl.js";
+import { a as loadModule, s as pickNamed, t as asPermissionTree } from "./load-DjSU5KXO.js";
+import { i as isModuleKey, n as MODULE_KEYS } from "./config-shape-ykV0Vm2n.js";
+import { existsSync, readFileSync, statSync } from "node:fs";
+import { dirname, relative, resolve } from "node:path";
+import { parseSync } from "oxc-parser";
+//#region src/cli/project/module-values.ts
+/** The export each module key is read from, as `load.ts` reads it. */
+const EXPORT_OF = {
+	policy: "policy",
+	permissions: "permissions",
+	operations: "operations"
+};
+const EXTENSIONS = [
+	".ts",
+	".tsx",
+	".mts",
+	".js",
+	".mjs",
+	".jsx"
+];
+function isFile(path) {
+	return existsSync(path) && statSync(path).isFile();
+}
+/** A relative specifier resolved the way a TypeScript bundler resolves it. */
+function resolveRelative(from, specifier) {
+	const base = resolve(dirname(from), specifier);
+	return [
+		base,
+		base.replace(/\.js$/u, ".ts").replace(/\.mjs$/u, ".mts"),
+		...EXTENSIONS.map((extension) => `${base}${extension}`),
+		...EXTENSIONS.map((extension) => resolve(base, `index${extension}`))
+	].find(isFile);
+}
+function relativeImports(file) {
+	const parsed = parseSync(file, readFileSync(file, "utf8"));
+	return [...new Set(parsed.module.staticImports.map((entry) => entry.moduleRequest.value).filter((specifier) => specifier.startsWith(".")))];
+}
+function fieldOf(value, key) {
+	return Reflect.get(value, key);
+}
+function leafKeys(value) {
+	try {
+		return listPermissions(asPermissionTree(value)).map((leaf) => leaf.key).toSorted().join(",");
+	} catch {
+		return "";
+	}
+}
+/**
+* Whether `exported` is the value the config passed. A module evaluated twice
+* (once natively, once through jiti, or fresh under `--watch`) yields a second
+* object, so a policy compares by fingerprint and a tree by its leaf keys.
+*/
+function sameValue(key, value, exported) {
+	if (exported === value) return true;
+	if (exported === null || typeof exported !== "object") return false;
+	switch (key) {
+		case "policy": {
+			const fingerprint = fieldOf(value, "fingerprint");
+			return typeof fingerprint === "string" && fingerprint === fieldOf(exported, "fingerprint");
+		}
+		case "permissions": return leafKeys(value) !== "" && leafKeys(value) === leafKeys(exported);
+		case "operations": {
+			const names = Object.keys(value).toSorted().join(",");
+			return names !== "" && names === Object.keys(exported).toSorted().join(",");
+		}
+		default: return key;
+	}
+}
+/**
+* The module path, relative to `cwd`, of the module the config file imports
+* `value` from as its `policy`, `permissions` or `operations` export.
+*/
+async function traceModuleValue(input) {
+	const name = EXPORT_OF[input.key];
+	for (const specifier of relativeImports(input.file)) {
+		const abs = resolveRelative(input.file, specifier);
+		if (abs === void 0) continue;
+		const mod = await loadModule(abs, input.options).catch(() => void 0);
+		if (mod !== void 0 && sameValue(input.key, input.value, pickNamed(mod, [name]))) {
+			const path = relative(input.cwd, abs).replaceAll("\\", "/");
+			return path.startsWith(".") ? path : `./${path}`;
+		}
+	}
+	throw configError(`PermDock CLI: ${input.display}: ${input.key} is a value no relative import of the config exports as '${name}' or default; import it from its module, or set ${input.key} to the module path`);
+}
+/**
+* `config` with each `policy`, `permissions` or `operations` value replaced by
+* the path of the module the config file imports it from, so every command
+* reads one form.
+*/
+async function traceModuleValues(input) {
+	const traced = { ...input.config };
+	for (const key of Object.keys(MODULE_KEYS)) {
+		const value = input.config[key];
+		if (!isModuleKey(key) || value === null || typeof value !== "object") continue;
+		traced[key] = await traceModuleValue({
+			...input,
+			key,
+			value
+		});
+	}
+	return traced;
+}
+//#endregion
+export { traceModuleValues };

package/dist/nest/index.d.ts

@@ -1,15 +1,16 @@
-import { T as Policy, sr as Principal } from "../policy-types-B-F-qAZk.js";
-import { u as Permission } from "../permission-types-DhNEmoRG.js";
-import { a as PermDock } from "../permdock-Dco6dyCK.js";
-import { n as RevocationFeed } from "../revocations-R07lFBnX.js";
-import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-C4gZUEZy.js";
-import { t as ServerAdapterOptions } from "../bind-JDuvxjuW.js";
+import { T as Policy, sr as Principal } from "../policy-types-CCiDRZBH.js";
+import { u as Permission } from "../permission-types-CAY-GU7e.js";
+import { a as PermDock } from "../permdock-B6Sf4T_S.js";
+import { n as RevocationFeed } from "../revocations-BaUXHM1N.js";
+import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CIlpSA2G.js";
+import { t as ServerAdapterOptions } from "../bind-Cp2hBHzP.js";
 import { r as sendResponse, t as NodeRequest } from "../http-B_LphE5Y.js";
 import { CanActivate, DynamicModule, ExceptionFilter, ExecutionContext, Type } from "@nestjs/common";
 //#region src/nest/http.d.ts
 /**
  * `@nestjs/platform-express` hands the guard an `IncomingMessage`;
- * `@nestjs/platform-fastify` hands it a `FastifyRequest` whose stream is `raw`.
+ * `@nestjs/platform-fastify` hands it a `FastifyRequest` whose stream is
+ * `raw`.
  */
 export declare function toRequest(req: NodeRequest): Request;
 //#endregion
@@ -30,18 +31,27 @@ type NestPermDockOptions<TUser = unknown> = ServerAdapterOptions<NestRequest, TU
 };
 /** A gateway client: Socket.IO (`emit`, `disconnect`) or `ws` (`close`). */
 type NestSocket = {
-  emit?(event: string, payload: unknown): unknown;
-  disconnect?(close?: boolean): unknown;
-  close?(code?: number, reason?: string): unknown;
+  emit?: (event: string, payload: unknown) => unknown;
+  disconnect?: (close?: boolean) => unknown;
+  close?: (code?: number, reason?: string) => unknown;
 };
-/** `Protect(null, data?, { oauthScopes })` needs a principal and one of the OAuth scopes, but no permission. */
+/**
+ * `Protect(null, data?, { oauthScopes })` needs a principal and one of the
+ * OAuth scopes, but no permission.
+ */
 type NestProtect = (permission: Permission | null, data?: (req: NestRequest) => unknown, protectOptions?: ProtectOptions) => ClassDecorator & MethodDecorator;
 type NestHandlerOptions = {
-  /** Controller path; may hold route params such as `:org`. Default `api/permdock`. */
+  /**
+   * Controller path; may hold route params such as `:org`. Default
+   * `api/permdock`.
+   */
   readonly path?: string;
 };
 type PermDockModuleOptions = {
-  /** `"global"` registers `PermDockGuard` as `APP_GUARD`, so every `Protect` rule runs without `UseGuards`. */
+  /**
+   * `"global"` registers `PermDockGuard` as `APP_GUARD`, so every `Protect`
+   * rule runs without `UseGuards`.
+   */
   readonly guard?: "global";
 };
 type NestPermDock = {

package/dist/nest/index.js

@@ -1,12 +1,12 @@
 import { t as compact } from "../compact-CAf557ZB.js";
-import { n as PermDockValidationError } from "../validation-error-ZfUHbKvf.js";
-import { n as PermDockDeniedError, r as PermDockRevokedError, t as PermDockApprovalRequiredError } from "../errors-BKy0EfhN.js";
-import { c as writeReply, r as hasCredentials } from "../http-BBoKefeS.js";
-import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-DReoiVBw.js";
-import { t as problemFromError } from "../map-error-BQGyDm_M.js";
-import { a as socketConnection, r as bindKernel } from "../bind-D1nO6fiC.js";
-import { a as onRevoked, n as closeReason, t as POLICY_VIOLATION } from "../stream-CvdUS9V1.js";
-import { n as sendResponse, r as toRequest$1, t as isServerResponse } from "../http-ujKm0JXE.js";
+import { n as PermDockValidationError } from "../validation-error-CYg2kJEw.js";
+import { n as PermDockDeniedError, r as PermDockRevokedError, t as PermDockApprovalRequiredError } from "../errors-B6R_lg2a.js";
+import { c as writeReply, r as hasCredentials } from "../http-DKLXrFGk.js";
+import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-IBceAeKT.js";
+import { t as problemFromError } from "../map-error-pasIGqMT.js";
+import { a as socketConnection, r as bindKernel } from "../bind-D_sZSVA3.js";
+import { a as onRevoked, n as closeReason, t as POLICY_VIOLATION } from "../stream-CDvF0sJm.js";
+import { n as sendResponse, r as toRequest$1, t as isServerResponse } from "../http-DH94eh6f.js";
 import { Catch, Controller, Get, Inject, Injectable, Module, Post, Req, Res, createParamDecorator } from "@nestjs/common";
 import { APP_FILTER, APP_GUARD, Reflector } from "@nestjs/core";
 //#region src/nest/decorate.ts
@@ -35,7 +35,8 @@ function isFastifyReply(value) {
 }
 /**
 * `@nestjs/platform-express` hands the guard an `IncomingMessage`;
-* `@nestjs/platform-fastify` hands it a `FastifyRequest` whose stream is `raw`.
+* `@nestjs/platform-fastify` hands it a `FastifyRequest` whose stream is
+* `raw`.
 */
 function toRequest(req) {
 	if (isReadable(req)) return toRequest$1(req);
@@ -75,7 +76,10 @@ function applyParameter(cls, key, index, decorator) {
 function hasEmit(value) {
 	return typeof value === "object" && value !== null && typeof value.emit === "function";
 }
-/** One call per loader for a request, so class and method rules naming the same loader share its row. */
+/**
+* One call per loader for a request, so class and method rules naming the same
+* loader share its row.
+*/
 function loadsFor(req) {
 	const loaded = /* @__PURE__ */ new Map();
 	return (loader) => {
@@ -130,7 +134,10 @@ function createPermDock(policy, options) {
 		});
 		return conn;
 	});
-	/** Decides each rule for a gateway message against the client's connection, as `protect` does for HTTP. */
+	/**
+	* Decides each rule for a gateway message against the client's connection, as
+	* `protect` does for HTTP.
+	*/
 	const checkMessage = async (rules, conn, req) => {
 		const request = req === void 0 ? void 0 : bind(req);
 		const load = loadsFor(req);

package/dist/next/client.d.ts

@@ -1,4 +1,4 @@
-import { t as PermissionBoundaryState } from "../boundary-BmHxVH1J.js";
+import { t as PermissionBoundaryState } from "../boundary-C9ck-3uK.js";
 import { ComponentType, ReactNode } from "react";
 //#region src/next/client.d.ts
 /** A fallback node, or a function of what was refused. */
@@ -6,7 +6,10 @@ export type PermissionBoundaryFallback = ReactNode | ((state: PermissionBoundary
 export type PermissionBoundaryProps = {
   /** Rendered in place of the children when one throws `PermDockDeniedError`. */
   readonly denied?: PermissionBoundaryFallback;
-  /** Rendered when a child throws `PermDockApprovalRequiredError`; defaults to `denied`. */
+  /**
+   * Rendered when a child throws `PermDockApprovalRequiredError`; defaults to
+   * `denied`.
+   */
   readonly approval?: PermissionBoundaryFallback;
 };
 /**

package/dist/next/client.js

@@ -1,5 +1,5 @@
 "use client";
-import { n as boundaryFallback, t as boundaryDigest } from "../boundary-BM8a_P6E.js";
+import { n as boundaryFallback, t as boundaryDigest } from "../boundary-BV3O1eud.js";
 import { createContext, useContext } from "react";
 import { jsx } from "react/jsx-runtime";
 import * as nextError from "next/error.js";