@grantex/sdk 0.2.5 → 0.3.0

package/dist/client.d.ts

@@ -18,6 +18,7 @@ import { DomainsClient } from './resources/domains.js';
 import { WebAuthnClient } from './resources/webauthn.js';
 import { CredentialsClient } from './resources/credentials.js';
 import { PassportsClient } from './resources/passports.js';
+import { ToolManifest, type EnforceOptions, type EnforceResult } from './manifest.js';
 import type { AuthorizationRequest, AuthorizeParams, GrantexClientOptions, RateLimit, RotateKeyResponse, SignupParams, SignupResponse, UpdateDeveloperSettingsParams, UpdateDeveloperSettingsResponse } from './types.js';
 export declare class Grantex {
     #private;
@@ -63,5 +64,34 @@ export declare class Grantex {
      * Update developer settings (e.g. FIDO/WebAuthn requirements).
      */
     updateSettings(params: UpdateDeveloperSettingsParams): Promise<UpdateDeveloperSettingsResponse>;
+    /**
+     * Load a tool manifest for scope enforcement.
+     * Manifests define what permission level each tool requires.
+     */
+    loadManifest(manifest: ToolManifest): void;
+    /**
+     * Load multiple tool manifests at once.
+     */
+    loadManifests(manifests: ToolManifest[]): void;
+    /**
+     * Enforce scope for a tool call.
+     *
+     * 1. Verifies the grant token JWT offline (JWKS cached, <1ms after first call)
+     * 2. Looks up the tool's required permission from loaded manifests
+     * 3. Checks if the granted scope level covers the required permission
+     *
+     * Fails closed: unknown connectors/tools are denied by default.
+     *
+     * @example
+     * ```ts
+     * const result = await grantex.enforce({
+     *   grantToken: token,
+     *   connector: 'salesforce',
+     *   tool: 'delete_contact',
+     * });
+     * if (!result.allowed) throw new Error(result.reason);
+     * ```
+     */
+    enforce(options: EnforceOptions): Promise<EnforceResult>;
 }
 //# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,uBAAuB,EAAE,MAAM,mCAAmC,CAAC;AAC5E,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,KAAK,EACV,oBAAoB,EACpB,eAAe,EACf,oBAAoB,EACpB,SAAS,EACT,iBAAiB,EACjB,YAAY,EACZ,cAAc,EACd,6BAA6B,EAC7B,+BAA+B,EAChC,MAAM,YAAY,CAAC;AAIpB,qBAAa,OAAO;;IAGlB,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IACtC,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IACpC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;IACxB,QAAQ,CAAC,iBAAiB,EAAE,uBAAuB,CAAC;IACpD,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAC;IACxC,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IAEpC,IAAI,aAAa,IAAI,SAAS,GAAG,SAAS,CAEzC;gBAEW,OAAO,GAAE,oBAAyB;IAsC9C;;;OAGG;WACU,MAAM,CACjB,MAAM,EAAE,YAAY,EACpB,OAAO,GAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAO,GACjC,OAAO,CAAC,cAAc,CAAC;IAuB1B;;;OAGG;IACH,SAAS,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAQjE;;OAEG;IACH,SAAS,IAAI,OAAO,CAAC,iBAAiB,CAAC;IAIvC;;OAEG;IACH,cAAc,CAAC,MAAM,EAAE,6BAA6B,GAAG,OAAO,CAAC,+BAA+B,CAAC;CAGhG"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,uBAAuB,EAAE,MAAM,mCAAmC,CAAC;AAC5E,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAgC,KAAK,cAAc,EAAE,KAAK,aAAa,EAAE,MAAM,eAAe,CAAC;AAEpH,OAAO,KAAK,EACV,oBAAoB,EACpB,eAAe,EACf,oBAAoB,EACpB,SAAS,EACT,iBAAiB,EACjB,YAAY,EACZ,cAAc,EACd,6BAA6B,EAC7B,+BAA+B,EAEhC,MAAM,YAAY,CAAC;AAIpB,qBAAa,OAAO;;IAKlB,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IACtC,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IACpC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;IACxB,QAAQ,CAAC,iBAAiB,EAAE,uBAAuB,CAAC;IACpD,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAC;IACxC,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IAEpC,IAAI,aAAa,IAAI,SAAS,GAAG,SAAS,CAEzC;gBAEW,OAAO,GAAE,oBAAyB;IAuC9C;;;OAGG;WACU,MAAM,CACjB,MAAM,EAAE,YAAY,EACpB,OAAO,GAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAO,GACjC,OAAO,CAAC,cAAc,CAAC;IAuB1B;;;OAGG;IACH,SAAS,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAQjE;;OAEG;IACH,SAAS,IAAI,OAAO,CAAC,iBAAiB,CAAC;IAIvC;;OAEG;IACH,cAAc,CAAC,MAAM,EAAE,6BAA6B,GAAG,OAAO,CAAC,+BAA+B,CAAC;IAI/F;;;OAGG;IACH,YAAY,CAAC,QAAQ,EAAE,YAAY,GAAG,IAAI;IAI1C;;OAEG;IACH,aAAa,CAAC,SAAS,EAAE,YAAY,EAAE,GAAG,IAAI;IAM9C;;;;;;;;;;;;;;;;;;OAkBG;IACG,OAAO,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;CAmI/D"}

package/dist/client.js

@@ -19,9 +19,13 @@ import { DomainsClient } from './resources/domains.js';
 import { WebAuthnClient } from './resources/webauthn.js';
 import { CredentialsClient } from './resources/credentials.js';
 import { PassportsClient } from './resources/passports.js';
+import { permissionCovers } from './manifest.js';
+import { verifyGrantToken } from './verify.js';
 const DEFAULT_BASE_URL = 'https://api.grantex.dev';
 export class Grantex {
     #http;
+    #manifests = new Map();
+    #jwksUri;
     agents;
     grants;
     tokens;
@@ -75,6 +79,7 @@ export class Grantex {
         this.webauthn = new WebAuthnClient(this.#http);
         this.credentials = new CredentialsClient(this.#http);
         this.passports = new PassportsClient(this.#http);
+        this.#jwksUri = `${(options.baseUrl ?? DEFAULT_BASE_URL).replace(/\/$/, '')}/.well-known/jwks.json`;
     }
     /**
      * Create a new developer account without an API key.
@@ -122,5 +127,158 @@ export class Grantex {
     updateSettings(params) {
         return this.#http.patch('/v1/me', params);
     }
+    /**
+     * Load a tool manifest for scope enforcement.
+     * Manifests define what permission level each tool requires.
+     */
+    loadManifest(manifest) {
+        this.#manifests.set(manifest.connector, manifest);
+    }
+    /**
+     * Load multiple tool manifests at once.
+     */
+    loadManifests(manifests) {
+        for (const m of manifests) {
+            this.#manifests.set(m.connector, m);
+        }
+    }
+    /**
+     * Enforce scope for a tool call.
+     *
+     * 1. Verifies the grant token JWT offline (JWKS cached, <1ms after first call)
+     * 2. Looks up the tool's required permission from loaded manifests
+     * 3. Checks if the granted scope level covers the required permission
+     *
+     * Fails closed: unknown connectors/tools are denied by default.
+     *
+     * @example
+     * ```ts
+     * const result = await grantex.enforce({
+     *   grantToken: token,
+     *   connector: 'salesforce',
+     *   tool: 'delete_contact',
+     * });
+     * if (!result.allowed) throw new Error(result.reason);
+     * ```
+     */
+    async enforce(options) {
+        const { grantToken, connector, tool, amount } = options;
+        const base = {
+            grantId: '',
+            agentDid: '',
+            scopes: [],
+            permission: '',
+            connector,
+            tool,
+        };
+        // 1. Verify the token offline via JWKS
+        let grant;
+        try {
+            grant = await verifyGrantToken(grantToken, { jwksUri: this.#jwksUri });
+        }
+        catch (err) {
+            return {
+                ...base,
+                allowed: false,
+                reason: `Token verification failed: ${err instanceof Error ? err.message : String(err)}`,
+            };
+        }
+        base.grantId = grant.grantId;
+        base.agentDid = grant.agentDid;
+        base.scopes = grant.scopes;
+        // 2. Look up manifest for the connector
+        const manifest = this.#manifests.get(connector);
+        if (!manifest) {
+            return {
+                ...base,
+                allowed: false,
+                reason: `No manifest loaded for connector '${connector}'. Load a manifest first.`,
+            };
+        }
+        // 3. Look up tool permission from manifest
+        const requiredPermission = manifest.getPermission(tool);
+        if (!requiredPermission) {
+            return {
+                ...base,
+                allowed: false,
+                reason: `Unknown tool '${tool}' on connector '${connector}'. Tool not found in manifest.`,
+            };
+        }
+        base.permission = requiredPermission;
+        // 4. Find the best matching scope for this connector
+        const grantedPermission = this.#resolveGrantedPermission(grant.scopes, connector);
+        if (!grantedPermission) {
+            return {
+                ...base,
+                allowed: false,
+                reason: `No scope grants access to connector '${connector}'.`,
+            };
+        }
+        // 5. Check permission hierarchy
+        if (!permissionCovers(grantedPermission, requiredPermission)) {
+            return {
+                ...base,
+                allowed: false,
+                reason: `${grantedPermission} scope does not permit ${requiredPermission} operations on ${connector}.`,
+            };
+        }
+        // 6. Check capped amount if provided
+        if (amount !== undefined) {
+            const cap = this.#extractCap(grant.scopes, connector);
+            if (cap !== undefined && amount > cap) {
+                return {
+                    ...base,
+                    allowed: false,
+                    reason: `Amount ${amount} exceeds budget cap of ${cap} on ${connector}.`,
+                };
+            }
+        }
+        return { ...base, allowed: true, reason: '' };
+    }
+    /**
+     * Resolve the highest granted permission level for a connector from scope strings.
+     * Scope format: `tool:{connector}:{permission}[:{resource}][:capped:{N}]`
+     */
+    #resolveGrantedPermission(scopes, connector) {
+        let best;
+        let bestLevel = -1;
+        const levels = { read: 0, write: 1, delete: 2, admin: 3 };
+        for (const scope of scopes) {
+            const parts = scope.split(':');
+            // Match: tool:{connector}:{permission}:...
+            if (parts[0] === 'tool' && parts[1] === connector && parts[2]) {
+                const level = levels[parts[2]] ?? -1;
+                if (level > bestLevel) {
+                    bestLevel = level;
+                    best = parts[2];
+                }
+            }
+            // Also match agenticorg:{connector}:{permission}
+            if (parts[0] === 'agenticorg' && parts[1] === connector && parts[2]) {
+                const level = levels[parts[2]] ?? -1;
+                if (level > bestLevel) {
+                    bestLevel = level;
+                    best = parts[2];
+                }
+            }
+        }
+        return best;
+    }
+    /**
+     * Extract the budget cap from capped scopes for a connector.
+     * Scope format: `tool:{connector}:{permission}:{resource}:capped:{N}`
+     */
+    #extractCap(scopes, connector) {
+        for (const scope of scopes) {
+            const parts = scope.split(':');
+            if (parts[0] === 'tool' && parts[1] === connector) {
+                const cappedIdx = parts.indexOf('capped');
+                if (cappedIdx !== -1 && parts[cappedIdx + 1]) {
+                    return Number(parts[cappedIdx + 1]);
+                }
+            }
+        }
+        return undefined;
+    }
 }
 //# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,uBAAuB,EAAE,MAAM,mCAAmC,CAAC;AAC5E,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAa3D,MAAM,gBAAgB,GAAG,yBAAyB,CAAC;AAEnD,MAAM,OAAO,OAAO;IACT,KAAK,CAAa;IAElB,MAAM,CAAe;IACrB,MAAM,CAAe;IACrB,MAAM,CAAe;IACrB,KAAK,CAAc;IACnB,QAAQ,CAAiB;IACzB,OAAO,CAAgB;IACvB,QAAQ,CAAiB;IACzB,UAAU,CAAmB;IAC7B,SAAS,CAAkB;IAC3B,IAAI,CAAa;IACjB,GAAG,CAAY;IACf,iBAAiB,CAA0B;IAC3C,KAAK,CAAc;IACnB,OAAO,CAAgB;IACvB,MAAM,CAAe;IACrB,KAAK,CAAc;IACnB,OAAO,CAAgB;IACvB,QAAQ,CAAiB;IACzB,WAAW,CAAoB;IAC/B,SAAS,CAAkB;IAEpC,IAAI,aAAa;QACf,OAAO,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC;IAClC,CAAC;IAED,YAAY,UAAgC,EAAE;QAC5C,MAAM,MAAM,GACV,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC;QAEzD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CACb,wGAAwG,CACzG,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,KAAK,GAAG,IAAI,UAAU,CAAC;YAC1B,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,gBAAgB;YAC5C,MAAM;YACN,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvE,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,CAAC,KAAK,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,CAAC,QAAQ,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/C,IAAI,CAAC,OAAO,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,CAAC,QAAQ,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/C,IAAI,CAAC,UAAU,GAAG,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnD,IAAI,CAAC,SAAS,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,CAAC,GAAG,GAAG,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,CAAC,iBAAiB,GAAG,IAAI,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjE,IAAI,CAAC,KAAK,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,IAAI,gBAAgB,CAAC,CAAC;QAC9E,IAAI,CAAC,OAAO,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,CAAC,KAAK,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,CAAC,OAAO,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,CAAC,QAAQ,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/C,IAAI,CAAC,WAAW,GAAG,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrD,IAAI,CAAC,SAAS,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnD,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,KAAK,CAAC,MAAM,CACjB,MAAoB,EACpB,UAAgC,EAAE;QAElC,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,gBAAgB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACzE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,YAAY,EAAE;YACnD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,MAAM,EAAE,kBAAkB;aAC3B;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;SAC7B,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;YACrD,MAAM,OAAO,GACX,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,SAAS,IAAI,IAAI;gBACnD,CAAC,CAAC,MAAM,CAAE,IAAgC,CAAC,SAAS,CAAC,CAAC;gBACtD,CAAC,CAAC,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;QAC3B,CAAC;QAED,OAAO,QAAQ,CAAC,IAAI,EAA6B,CAAC;IACpD,CAAC;IAED;;;OAGG;IACH,SAAS,CAAC,MAAuB;QAC/B,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC;QACnC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAuB,eAAe,EAAE;YAC5D,GAAG,IAAI;YACP,WAAW,EAAE,MAAM;SACpB,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,SAAS;QACP,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAoB,iBAAiB,CAAC,CAAC;IAC/D,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,MAAqC;QAClD,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAkC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC7E,CAAC;CACF"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,uBAAuB,EAAE,MAAM,mCAAmC,CAAC;AAC5E,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAA4B,gBAAgB,EAA2C,MAAM,eAAe,CAAC;AACpH,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAc/C,MAAM,gBAAgB,GAAG,yBAAyB,CAAC;AAEnD,MAAM,OAAO,OAAO;IACT,KAAK,CAAa;IAClB,UAAU,GAA8B,IAAI,GAAG,EAAE,CAAC;IAC3D,QAAQ,CAAS;IAER,MAAM,CAAe;IACrB,MAAM,CAAe;IACrB,MAAM,CAAe;IACrB,KAAK,CAAc;IACnB,QAAQ,CAAiB;IACzB,OAAO,CAAgB;IACvB,QAAQ,CAAiB;IACzB,UAAU,CAAmB;IAC7B,SAAS,CAAkB;IAC3B,IAAI,CAAa;IACjB,GAAG,CAAY;IACf,iBAAiB,CAA0B;IAC3C,KAAK,CAAc;IACnB,OAAO,CAAgB;IACvB,MAAM,CAAe;IACrB,KAAK,CAAc;IACnB,OAAO,CAAgB;IACvB,QAAQ,CAAiB;IACzB,WAAW,CAAoB;IAC/B,SAAS,CAAkB;IAEpC,IAAI,aAAa;QACf,OAAO,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC;IAClC,CAAC;IAED,YAAY,UAAgC,EAAE;QAC5C,MAAM,MAAM,GACV,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC;QAEzD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CACb,wGAAwG,CACzG,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,KAAK,GAAG,IAAI,UAAU,CAAC;YAC1B,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,gBAAgB;YAC5C,MAAM;YACN,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvE,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,CAAC,KAAK,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,CAAC,QAAQ,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/C,IAAI,CAAC,OAAO,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,CAAC,QAAQ,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/C,IAAI,CAAC,UAAU,GAAG,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnD,IAAI,CAAC,SAAS,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,CAAC,GAAG,GAAG,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,CAAC,iBAAiB,GAAG,IAAI,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjE,IAAI,CAAC,KAAK,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,IAAI,gBAAgB,CAAC,CAAC;QAC9E,IAAI,CAAC,OAAO,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,CAAC,KAAK,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,CAAC,OAAO,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,CAAC,QAAQ,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/C,IAAI,CAAC,WAAW,GAAG,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrD,IAAI,CAAC,SAAS,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjD,IAAI,CAAC,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,gBAAgB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,wBAAwB,CAAC;IACtG,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,KAAK,CAAC,MAAM,CACjB,MAAoB,EACpB,UAAgC,EAAE;QAElC,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,gBAAgB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACzE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,YAAY,EAAE;YACnD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,MAAM,EAAE,kBAAkB;aAC3B;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;SAC7B,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;YACrD,MAAM,OAAO,GACX,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,SAAS,IAAI,IAAI;gBACnD,CAAC,CAAC,MAAM,CAAE,IAAgC,CAAC,SAAS,CAAC,CAAC;gBACtD,CAAC,CAAC,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;QAC3B,CAAC;QAED,OAAO,QAAQ,CAAC,IAAI,EAA6B,CAAC;IACpD,CAAC;IAED;;;OAGG;IACH,SAAS,CAAC,MAAuB;QAC/B,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC;QACnC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAuB,eAAe,EAAE;YAC5D,GAAG,IAAI;YACP,WAAW,EAAE,MAAM;SACpB,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,SAAS;QACP,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAoB,iBAAiB,CAAC,CAAC;IAC/D,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,MAAqC;QAClD,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAkC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC7E,CAAC;IAED;;;OAGG;IACH,YAAY,CAAC,QAAsB;QACjC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACpD,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,SAAyB;QACrC,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;YAC1B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,KAAK,CAAC,OAAO,CAAC,OAAuB;QACnC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;QACxD,MAAM,IAAI,GAA8C;YACtD,OAAO,EAAE,EAAE;YACX,QAAQ,EAAE,EAAE;YACZ,MAAM,EAAE,EAAE;YACV,UAAU,EAAE,EAAE;YACd,SAAS;YACT,IAAI;SACL,CAAC;QAEF,uCAAuC;QACvC,IAAI,KAAoB,CAAC;QACzB,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,gBAAgB,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QACzE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO;gBACL,GAAG,IAAI;gBACP,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,8BAA8B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;aACzF,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;QAC7B,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;QAC/B,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QAE3B,wCAAwC;QACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAChD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO;gBACL,GAAG,IAAI;gBACP,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,qCAAqC,SAAS,2BAA2B;aAClF,CAAC;QACJ,CAAC;QAED,2CAA2C;QAC3C,MAAM,kBAAkB,GAAG,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QACxD,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACxB,OAAO;gBACL,GAAG,IAAI;gBACP,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,iBAAiB,IAAI,mBAAmB,SAAS,gCAAgC;aAC1F,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,UAAU,GAAG,kBAAkB,CAAC;QAErC,qDAAqD;QACrD,MAAM,iBAAiB,GAAG,IAAI,CAAC,yBAAyB,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAClF,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,OAAO;gBACL,GAAG,IAAI;gBACP,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,wCAAwC,SAAS,IAAI;aAC9D,CAAC;QACJ,CAAC;QAED,gCAAgC;QAChC,IAAI,CAAC,gBAAgB,CAAC,iBAAiB,EAAE,kBAAkB,CAAC,EAAE,CAAC;YAC7D,OAAO;gBACL,GAAG,IAAI;gBACP,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,GAAG,iBAAiB,0BAA0B,kBAAkB,kBAAkB,SAAS,GAAG;aACvG,CAAC;QACJ,CAAC;QAED,qCAAqC;QACrC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YACtD,IAAI,GAAG,KAAK,SAAS,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;gBACtC,OAAO;oBACL,GAAG,IAAI;oBACP,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,UAAU,MAAM,0BAA0B,GAAG,OAAO,SAAS,GAAG;iBACzE,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAChD,CAAC;IAED;;;OAGG;IACH,yBAAyB,CAAC,MAAgB,EAAE,SAAiB;QAC3D,IAAI,IAAwB,CAAC;QAC7B,IAAI,SAAS,GAAG,CAAC,CAAC,CAAC;QAEnB,MAAM,MAAM,GAA2B,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QAElF,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC/B,2CAA2C;YAC3C,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9D,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;gBACrC,IAAI,KAAK,GAAG,SAAS,EAAE,CAAC;oBACtB,SAAS,GAAG,KAAK,CAAC;oBAClB,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBAClB,CAAC;YACH,CAAC;YACD,iDAAiD;YACjD,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,YAAY,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpE,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;gBACrC,IAAI,KAAK,GAAG,SAAS,EAAE,CAAC;oBACtB,SAAS,GAAG,KAAK,CAAC;oBAClB,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBAClB,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;OAGG;IACH,WAAW,CAAC,MAAgB,EAAE,SAAiB;QAC7C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;gBAClD,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;gBAC1C,IAAI,SAAS,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,EAAE,CAAC;oBAC7C,OAAO,MAAM,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC;gBACtC,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;CACF"}

package/dist/index.d.ts

@@ -5,5 +5,6 @@ export { generatePkce, type PkceChallenge } from './pkce.js';
 export { GrantexError, GrantexApiError, GrantexAuthError, GrantexTokenError, GrantexNetworkError, } from './errors.js';
 export { EventsClient, type GrantexEvent as GrantexStreamEvent, type StreamOptions, type EventHandler } from './resources/events.js';
 export { PassportsClient, type IssuePassportParams, type IssuedPassportResponse, type GetPassportResponse, type RevokePassportResponse, type ListPassportsParams, } from './resources/passports.js';
+export { ToolManifest, Permission, permissionCovers, type EnforceOptions, type EnforceResult, type ToolManifestOptions } from './manifest.js';
 export type { RateLimit, GrantexClientOptions, SignupParams, SignupResponse, RotateKeyResponse, Agent, RegisterAgentParams, UpdateAgentParams, ListAgentsResponse, AuthorizeParams, AuthorizationRequest, Grant, ListGrantsParams, ListGrantsResponse, VerifiedGrant, DelegateParams, ExchangeTokenParams, ExchangeTokenResponse, RefreshTokenParams, VerifyTokenResponse, CreatePrincipalSessionParams, PrincipalSessionResponse, LogAuditParams, AuditEntry, ListAuditParams, ListAuditResponse, VerifyGrantTokenOptions, WebhookEventType, CreateWebhookParams, WebhookEndpoint, WebhookEndpointWithSecret, ListWebhooksResponse, SubscriptionStatus, CreateCheckoutParams, CheckoutResponse, CreatePortalParams, PortalResponse, Policy, CreatePolicyParams, UpdatePolicyParams, ListPoliciesResponse, AnomalyType, AnomalySeverity, Anomaly, DetectAnomaliesResponse, ListAnomaliesResponse, ScimEmail, ScimUserMeta, ScimUser, ScimListResponse, CreateScimUserParams, UpdateScimUserParams, ScimToken, ScimTokenWithSecret, CreateScimTokenParams, ListScimTokensResponse, SsoConfig, CreateSsoConfigParams, SsoLoginResponse, SsoCallbackResponse, StoreCredentialParams, StoreCredentialResponse, VaultCredential, ListVaultCredentialsParams, ListVaultCredentialsResponse, ExchangeCredentialParams, ExchangeCredentialResponse, AllocateBudgetParams, BudgetAllocation, DebitBudgetParams, DebitBudgetResponse, BudgetTransaction, BudgetTransactionsResponse, ComplianceSummary, ComplianceExportGrantsParams, ComplianceExportAuditParams, ComplianceGrantsExport, ComplianceAuditExport, EvidencePackParams, EvidencePack, ChainIntegrity, UsageResponse, UsageHistoryEntry, UsageHistoryResponse, CreateDomainParams, CreateDomainResponse, DomainEntry, ListDomainsResponse, VerifyDomainResponse, WebAuthnRegistrationOptions, WebAuthnRegistrationVerifyParams, WebAuthnCredential, ListWebAuthnCredentialsResponse, VerifiableCredentialRecord, ListCredentialsParams, ListCredentialsResponse, VCVerificationResult, SDJWTPresentParams, SDJWTPresentResult, UpdateDeveloperSettingsParams, UpdateDeveloperSettingsResponse, } from './types.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAGtC,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAG/C,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAGtD,OAAO,EAAE,YAAY,EAAE,KAAK,aAAa,EAAE,MAAM,WAAW,CAAC;AAG7D,OAAO,EACL,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,aAAa,CAAC;AAGrB,OAAO,EAAE,YAAY,EAAE,KAAK,YAAY,IAAI,kBAAkB,EAAE,KAAK,aAAa,EAAE,KAAK,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAGrI,OAAO,EACL,eAAe,EACf,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,GACzB,MAAM,0BAA0B,CAAC;AAGlC,YAAY,EACV,SAAS,EACT,oBAAoB,EAEpB,YAAY,EACZ,cAAc,EACd,iBAAiB,EAEjB,KAAK,EACL,mBAAmB,EACnB,iBAAiB,EACjB,kBAAkB,EAElB,eAAe,EACf,oBAAoB,EAEpB,KAAK,EACL,gBAAgB,EAChB,kBAAkB,EAClB,aAAa,EACb,cAAc,EAEd,mBAAmB,EACnB,qBAAqB,EACrB,kBAAkB,EAClB,mBAAmB,EAEnB,4BAA4B,EAC5B,wBAAwB,EAExB,cAAc,EACd,UAAU,EACV,eAAe,EACf,iBAAiB,EAEjB,uBAAuB,EAEvB,gBAAgB,EAChB,mBAAmB,EACnB,eAAe,EACf,yBAAyB,EACzB,oBAAoB,EAEpB,kBAAkB,EAClB,oBAAoB,EACpB,gBAAgB,EAChB,kBAAkB,EAClB,cAAc,EAEd,MAAM,EACN,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EAEpB,WAAW,EACX,eAAe,EACf,OAAO,EACP,uBAAuB,EACvB,qBAAqB,EAErB,SAAS,EACT,YAAY,EACZ,QAAQ,EACR,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,EACpB,SAAS,EACT,mBAAmB,EACnB,qBAAqB,EACrB,sBAAsB,EAEtB,SAAS,EACT,qBAAqB,EACrB,gBAAgB,EAChB,mBAAmB,EAEnB,qBAAqB,EACrB,uBAAuB,EACvB,eAAe,EACf,0BAA0B,EAC1B,4BAA4B,EAC5B,wBAAwB,EACxB,0BAA0B,EAE1B,oBAAoB,EACpB,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,0BAA0B,EAE1B,iBAAiB,EACjB,4BAA4B,EAC5B,2BAA2B,EAC3B,sBAAsB,EACtB,qBAAqB,EACrB,kBAAkB,EAClB,YAAY,EACZ,cAAc,EAEd,aAAa,EACb,iBAAiB,EACjB,oBAAoB,EAEpB,kBAAkB,EAClB,oBAAoB,EACpB,WAAW,EACX,mBAAmB,EACnB,oBAAoB,EAEpB,2BAA2B,EAC3B,gCAAgC,EAChC,kBAAkB,EAClB,+BAA+B,EAE/B,0BAA0B,EAC1B,qBAAqB,EACrB,uBAAuB,EACvB,oBAAoB,EAEpB,kBAAkB,EAClB,kBAAkB,EAElB,6BAA6B,EAC7B,+BAA+B,GAChC,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAGtC,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAG/C,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAGtD,OAAO,EAAE,YAAY,EAAE,KAAK,aAAa,EAAE,MAAM,WAAW,CAAC;AAG7D,OAAO,EACL,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,aAAa,CAAC;AAGrB,OAAO,EAAE,YAAY,EAAE,KAAK,YAAY,IAAI,kBAAkB,EAAE,KAAK,aAAa,EAAE,KAAK,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAGrI,OAAO,EACL,eAAe,EACf,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,GACzB,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,gBAAgB,EAAE,KAAK,cAAc,EAAE,KAAK,aAAa,EAAE,KAAK,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAG9I,YAAY,EACV,SAAS,EACT,oBAAoB,EAEpB,YAAY,EACZ,cAAc,EACd,iBAAiB,EAEjB,KAAK,EACL,mBAAmB,EACnB,iBAAiB,EACjB,kBAAkB,EAElB,eAAe,EACf,oBAAoB,EAEpB,KAAK,EACL,gBAAgB,EAChB,kBAAkB,EAClB,aAAa,EACb,cAAc,EAEd,mBAAmB,EACnB,qBAAqB,EACrB,kBAAkB,EAClB,mBAAmB,EAEnB,4BAA4B,EAC5B,wBAAwB,EAExB,cAAc,EACd,UAAU,EACV,eAAe,EACf,iBAAiB,EAEjB,uBAAuB,EAEvB,gBAAgB,EAChB,mBAAmB,EACnB,eAAe,EACf,yBAAyB,EACzB,oBAAoB,EAEpB,kBAAkB,EAClB,oBAAoB,EACpB,gBAAgB,EAChB,kBAAkB,EAClB,cAAc,EAEd,MAAM,EACN,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EAEpB,WAAW,EACX,eAAe,EACf,OAAO,EACP,uBAAuB,EACvB,qBAAqB,EAErB,SAAS,EACT,YAAY,EACZ,QAAQ,EACR,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,EACpB,SAAS,EACT,mBAAmB,EACnB,qBAAqB,EACrB,sBAAsB,EAEtB,SAAS,EACT,qBAAqB,EACrB,gBAAgB,EAChB,mBAAmB,EAEnB,qBAAqB,EACrB,uBAAuB,EACvB,eAAe,EACf,0BAA0B,EAC1B,4BAA4B,EAC5B,wBAAwB,EACxB,0BAA0B,EAE1B,oBAAoB,EACpB,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,0BAA0B,EAE1B,iBAAiB,EACjB,4BAA4B,EAC5B,2BAA2B,EAC3B,sBAAsB,EACtB,qBAAqB,EACrB,kBAAkB,EAClB,YAAY,EACZ,cAAc,EAEd,aAAa,EACb,iBAAiB,EACjB,oBAAoB,EAEpB,kBAAkB,EAClB,oBAAoB,EACpB,WAAW,EACX,mBAAmB,EACnB,oBAAoB,EAEpB,2BAA2B,EAC3B,gCAAgC,EAChC,kBAAkB,EAClB,+BAA+B,EAE/B,0BAA0B,EAC1B,qBAAqB,EACrB,uBAAuB,EACvB,oBAAoB,EAEpB,kBAAkB,EAClB,kBAAkB,EAElB,6BAA6B,EAC7B,+BAA+B,GAChC,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -12,4 +12,6 @@ export { GrantexError, GrantexApiError, GrantexAuthError, GrantexTokenError, Gra
 export { EventsClient } from './resources/events.js';
 // Passports (MPP Agent Identity)
 export { PassportsClient, } from './resources/passports.js';
+// Scope enforcement
+export { ToolManifest, Permission, permissionCovers } from './manifest.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc;AACd,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAEtC,4DAA4D;AAC5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE/C,iCAAiC;AACjC,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAEtD,cAAc;AACd,OAAO,EAAE,YAAY,EAAsB,MAAM,WAAW,CAAC;AAE7D,gBAAgB;AAChB,OAAO,EACL,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,aAAa,CAAC;AAErB,kBAAkB;AAClB,OAAO,EAAE,YAAY,EAAkF,MAAM,uBAAuB,CAAC;AAErI,iCAAiC;AACjC,OAAO,EACL,eAAe,GAMhB,MAAM,0BAA0B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc;AACd,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAEtC,4DAA4D;AAC5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE/C,iCAAiC;AACjC,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAEtD,cAAc;AACd,OAAO,EAAE,YAAY,EAAsB,MAAM,WAAW,CAAC;AAE7D,gBAAgB;AAChB,OAAO,EACL,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,aAAa,CAAC;AAErB,kBAAkB;AAClB,OAAO,EAAE,YAAY,EAAkF,MAAM,uBAAuB,CAAC;AAErI,iCAAiC;AACjC,OAAO,EACL,eAAe,GAMhB,MAAM,0BAA0B,CAAC;AAElC,oBAAoB;AACpB,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,gBAAgB,EAAqE,MAAM,eAAe,CAAC"}

package/dist/manifest.d.ts

@@ -0,0 +1,108 @@
+/**
+ * Tool Manifest & Permission — scope enforcement for AI agent tool calls.
+ *
+ * A ToolManifest declares the permission level (read/write/delete/admin)
+ * required for each tool on a connector. The `enforce()` method on the
+ * Grantex client uses loaded manifests to check whether a grant token's
+ * scopes allow a given tool call.
+ *
+ * @example
+ * ```ts
+ * import { ToolManifest, Permission } from '@grantex/sdk';
+ *
+ * const manifest = new ToolManifest({
+ *   connector: 'salesforce',
+ *   tools: {
+ *     query: Permission.READ,
+ *     create_lead: Permission.WRITE,
+ *     delete_contact: Permission.DELETE,
+ *   },
+ * });
+ * ```
+ */
+/** Permission levels for tool operations. */
+export declare enum Permission {
+    READ = "read",
+    WRITE = "write",
+    DELETE = "delete",
+    ADMIN = "admin"
+}
+/**
+ * Check whether a granted permission level covers the required level.
+ *
+ * Hierarchy: `admin > delete > write > read`
+ *
+ * - A `write` scope covers `read` + `write` tools.
+ * - A `delete` scope covers `read` + `write` + `delete` tools.
+ * - An `admin` scope covers everything.
+ */
+export declare function permissionCovers(granted: string, required: string): boolean;
+export interface ToolManifestOptions {
+    /** Connector name (e.g., "salesforce", "hubspot"). */
+    connector: string;
+    /** Tool name → Permission mapping. */
+    tools: Record<string, Permission>;
+    /** Manifest version (default "1.0.0"). */
+    version?: string;
+    /** Human-readable description. */
+    description?: string;
+}
+/**
+ * Declares the required permission level for each tool on a connector.
+ *
+ * Load manifests via `grantex.loadManifest()` and they will be used
+ * automatically by `grantex.enforce()`.
+ */
+export declare class ToolManifest {
+    readonly connector: string;
+    readonly tools: Record<string, Permission>;
+    readonly version: string;
+    readonly description: string;
+    constructor(options: ToolManifestOptions);
+    /** Get the declared permission for a tool. Returns undefined if not found. */
+    getPermission(toolName: string): Permission | undefined;
+    /** Add or update a tool's permission in this manifest. */
+    addTool(toolName: string, permission: Permission): void;
+    /** Number of tools in this manifest. */
+    get toolCount(): number;
+    /**
+     * Create a ToolManifest from a JSON object (e.g., loaded from file).
+     *
+     * Expected shape:
+     * ```json
+     * { "connector": "salesforce", "tools": { "query": "read", ... } }
+     * ```
+     */
+    static fromJSON(data: Record<string, unknown>): ToolManifest;
+}
+/** Result of a `grantex.enforce()` call. */
+export interface EnforceResult {
+    /** Whether the tool call is permitted. */
+    allowed: boolean;
+    /** Human-readable reason if denied. */
+    reason: string;
+    /** Grant ID from the JWT (empty if token invalid). */
+    grantId: string;
+    /** Agent DID from the JWT (empty if token invalid). */
+    agentDid: string;
+    /** All scopes from the grant token. */
+    scopes: string[];
+    /** Resolved permission for the requested tool. */
+    permission: string;
+    /** Connector name. */
+    connector: string;
+    /** Tool name. */
+    tool: string;
+}
+/** Options for `grantex.enforce()`. */
+export interface EnforceOptions {
+    /** The Grantex grant token (JWT). */
+    grantToken: string;
+    /** Connector name (e.g., "salesforce"). */
+    connector: string;
+    /** Tool name (e.g., "delete_contact"). */
+    tool: string;
+    /** Amount for capped scope enforcement (optional). */
+    amount?: number;
+}
+//# sourceMappingURL=manifest.d.ts.map

package/dist/manifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAMH,6CAA6C;AAC7C,oBAAY,UAAU;IACpB,IAAI,SAAS;IACb,KAAK,UAAU;IACf,MAAM,WAAW;IACjB,KAAK,UAAU;CAChB;AASD;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAI3E;AAMD,MAAM,WAAW,mBAAmB;IAClC,sDAAsD;IACtD,SAAS,EAAE,MAAM,CAAC;IAClB,sCAAsC;IACtC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAClC,0CAA0C;IAC1C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;GAKG;AACH,qBAAa,YAAY;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC3C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;gBAEjB,OAAO,EAAE,mBAAmB;IAqBxC,8EAA8E;IAC9E,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS;IAIvD,0DAA0D;IAC1D,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,GAAG,IAAI;IAIvD,wCAAwC;IACxC,IAAI,SAAS,IAAI,MAAM,CAEtB;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,YAAY;CAa7D;AAMD,4CAA4C;AAC5C,MAAM,WAAW,aAAa;IAC5B,0CAA0C;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,uCAAuC;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,sDAAsD;IACtD,OAAO,EAAE,MAAM,CAAC;IAChB,uDAAuD;IACvD,QAAQ,EAAE,MAAM,CAAC;IACjB,uCAAuC;IACvC,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,kDAAkD;IAClD,UAAU,EAAE,MAAM,CAAC;IACnB,sBAAsB;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB;IACjB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,uCAAuC;AACvC,MAAM,WAAW,cAAc;IAC7B,qCAAqC;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,2CAA2C;IAC3C,SAAS,EAAE,MAAM,CAAC;IAClB,0CAA0C;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,sDAAsD;IACtD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB"}

package/dist/manifest.js

@@ -0,0 +1,116 @@
+/**
+ * Tool Manifest & Permission — scope enforcement for AI agent tool calls.
+ *
+ * A ToolManifest declares the permission level (read/write/delete/admin)
+ * required for each tool on a connector. The `enforce()` method on the
+ * Grantex client uses loaded manifests to check whether a grant token's
+ * scopes allow a given tool call.
+ *
+ * @example
+ * ```ts
+ * import { ToolManifest, Permission } from '@grantex/sdk';
+ *
+ * const manifest = new ToolManifest({
+ *   connector: 'salesforce',
+ *   tools: {
+ *     query: Permission.READ,
+ *     create_lead: Permission.WRITE,
+ *     delete_contact: Permission.DELETE,
+ *   },
+ * });
+ * ```
+ */
+/* ------------------------------------------------------------------ */
+/*  Permission                                                         */
+/* ------------------------------------------------------------------ */
+/** Permission levels for tool operations. */
+export var Permission;
+(function (Permission) {
+    Permission["READ"] = "read";
+    Permission["WRITE"] = "write";
+    Permission["DELETE"] = "delete";
+    Permission["ADMIN"] = "admin";
+})(Permission || (Permission = {}));
+const PERMISSION_LEVELS = {
+    [Permission.READ]: 0,
+    [Permission.WRITE]: 1,
+    [Permission.DELETE]: 2,
+    [Permission.ADMIN]: 3,
+};
+/**
+ * Check whether a granted permission level covers the required level.
+ *
+ * Hierarchy: `admin > delete > write > read`
+ *
+ * - A `write` scope covers `read` + `write` tools.
+ * - A `delete` scope covers `read` + `write` + `delete` tools.
+ * - An `admin` scope covers everything.
+ */
+export function permissionCovers(granted, required) {
+    const grantedLevel = PERMISSION_LEVELS[granted] ?? -1;
+    const requiredLevel = PERMISSION_LEVELS[required] ?? 99;
+    return grantedLevel >= requiredLevel;
+}
+/**
+ * Declares the required permission level for each tool on a connector.
+ *
+ * Load manifests via `grantex.loadManifest()` and they will be used
+ * automatically by `grantex.enforce()`.
+ */
+export class ToolManifest {
+    connector;
+    tools;
+    version;
+    description;
+    constructor(options) {
+        if (!options.connector) {
+            throw new Error('ToolManifest: connector name is required');
+        }
+        if (!options.tools || Object.keys(options.tools).length === 0) {
+            throw new Error('ToolManifest: at least one tool is required');
+        }
+        for (const [name, perm] of Object.entries(options.tools)) {
+            if (!Object.values(Permission).includes(perm)) {
+                throw new Error(`ToolManifest: invalid permission "${perm}" for tool "${name}". Must be one of: ${Object.values(Permission).join(', ')}`);
+            }
+        }
+        this.connector = options.connector;
+        this.tools = { ...options.tools };
+        this.version = options.version ?? '1.0.0';
+        this.description = options.description ?? '';
+    }
+    /** Get the declared permission for a tool. Returns undefined if not found. */
+    getPermission(toolName) {
+        return this.tools[toolName];
+    }
+    /** Add or update a tool's permission in this manifest. */
+    addTool(toolName, permission) {
+        this.tools[toolName] = permission;
+    }
+    /** Number of tools in this manifest. */
+    get toolCount() {
+        return Object.keys(this.tools).length;
+    }
+    /**
+     * Create a ToolManifest from a JSON object (e.g., loaded from file).
+     *
+     * Expected shape:
+     * ```json
+     * { "connector": "salesforce", "tools": { "query": "read", ... } }
+     * ```
+     */
+    static fromJSON(data) {
+        const connector = data['connector'];
+        const tools = data['tools'];
+        if (!connector || !tools) {
+            throw new Error('ToolManifest.fromJSON: missing "connector" or "tools" field');
+        }
+        return new ToolManifest({
+            connector,
+            tools: tools,
+            version: data['version'] ?? '1.0.0',
+            description: data['description'] ?? '',
+        });
+    }
+}
+//# sourceMappingURL=manifest.js.map

package/dist/manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,wEAAwE;AACxE,yEAAyE;AACzE,wEAAwE;AAExE,6CAA6C;AAC7C,MAAM,CAAN,IAAY,UAKX;AALD,WAAY,UAAU;IACpB,2BAAa,CAAA;IACb,6BAAe,CAAA;IACf,+BAAiB,CAAA;IACjB,6BAAe,CAAA;AACjB,CAAC,EALW,UAAU,KAAV,UAAU,QAKrB;AAED,MAAM,iBAAiB,GAA+B;IACpD,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;IACpB,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;IACrB,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;IACtB,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;CACtB,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe,EAAE,QAAgB;IAChE,MAAM,YAAY,GAAG,iBAAiB,CAAC,OAAqB,CAAC,IAAI,CAAC,CAAC,CAAC;IACpE,MAAM,aAAa,GAAG,iBAAiB,CAAC,QAAsB,CAAC,IAAI,EAAE,CAAC;IACtE,OAAO,YAAY,IAAI,aAAa,CAAC;AACvC,CAAC;AAiBD;;;;;GAKG;AACH,MAAM,OAAO,YAAY;IACd,SAAS,CAAS;IAClB,KAAK,CAA6B;IAClC,OAAO,CAAS;IAChB,WAAW,CAAS;IAE7B,YAAY,OAA4B;QACtC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC9D,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACjE,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,IAAkB,CAAC,EAAE,CAAC;gBAC5D,MAAM,IAAI,KAAK,CACb,qCAAqC,IAAI,eAAe,IAAI,sBAAsB,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACzH,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,KAAK,GAAG,EAAE,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;QAClC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC;QAC1C,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC;IAC/C,CAAC;IAED,8EAA8E;IAC9E,aAAa,CAAC,QAAgB;QAC5B,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC9B,CAAC;IAED,0DAA0D;IAC1D,OAAO,CAAC,QAAgB,EAAE,UAAsB;QAC7C,IAAI,CAAC,KAAoC,CAAC,QAAQ,CAAC,GAAG,UAAU,CAAC;IACpE,CAAC;IAED,wCAAwC;IACxC,IAAI,SAAS;QACX,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;IACxC,CAAC;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,QAAQ,CAAC,IAA6B;QAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAuB,CAAC;QAC1D,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAuC,CAAC;QAClE,IAAI,CAAC,SAAS,IAAI,CAAC,KAAK,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,IAAI,YAAY,CAAC;YACtB,SAAS;YACT,KAAK,EAAE,KAAmC;YAC1C,OAAO,EAAG,IAAI,CAAC,SAAS,CAAY,IAAI,OAAO;YAC/C,WAAW,EAAG,IAAI,CAAC,aAAa,CAAY,IAAI,EAAE;SACnD,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/manifests/ahrefs.d.ts

@@ -0,0 +1,3 @@
+import { ToolManifest } from '../manifest.js';
+export declare const ahrefsManifest: ToolManifest;
+//# sourceMappingURL=ahrefs.d.ts.map

package/dist/manifests/ahrefs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ahrefs.d.ts","sourceRoot":"","sources":["../../src/manifests/ahrefs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAc,MAAM,gBAAgB,CAAC;AAE1D,eAAO,MAAM,cAAc,cAUzB,CAAC"}

package/dist/manifests/ahrefs.js

@@ -0,0 +1,13 @@
+import { ToolManifest, Permission } from '../manifest.js';
+export const ahrefsManifest = new ToolManifest({
+    connector: 'ahrefs',
+    description: 'Ahrefs SEO API',
+    tools: {
+        get_domain_rating: Permission.READ,
+        get_backlinks: Permission.READ,
+        get_organic_keywords: Permission.READ,
+        get_content_gap: Permission.READ,
+        get_site_audit: Permission.READ,
+    },
+});
+//# sourceMappingURL=ahrefs.js.map

package/dist/manifests/ahrefs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ahrefs.js","sourceRoot":"","sources":["../../src/manifests/ahrefs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAE1D,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,YAAY,CAAC;IAC7C,SAAS,EAAE,QAAQ;IACnB,WAAW,EAAE,gBAAgB;IAC7B,KAAK,EAAE;QACL,iBAAiB,EAAE,UAAU,CAAC,IAAI;QAClC,aAAa,EAAE,UAAU,CAAC,IAAI;QAC9B,oBAAoB,EAAE,UAAU,CAAC,IAAI;QACrC,eAAe,EAAE,UAAU,CAAC,IAAI;QAChC,cAAc,EAAE,UAAU,CAAC,IAAI;KAChC;CACF,CAAC,CAAC"}

package/dist/manifests/banking_aa.d.ts

@@ -0,0 +1,3 @@
+import { ToolManifest } from '../manifest.js';
+export declare const bankingAaManifest: ToolManifest;
+//# sourceMappingURL=banking_aa.d.ts.map

package/dist/manifests/banking_aa.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"banking_aa.d.ts","sourceRoot":"","sources":["../../src/manifests/banking_aa.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAc,MAAM,gBAAgB,CAAC;AAE1D,eAAO,MAAM,iBAAiB,cAU5B,CAAC"}

package/dist/manifests/banking_aa.js

@@ -0,0 +1,13 @@
+import { ToolManifest, Permission } from '../manifest.js';
+export const bankingAaManifest = new ToolManifest({
+    connector: 'banking_aa',
+    description: 'Banking Account Aggregator API',
+    tools: {
+        fetch_bank_statement: Permission.READ,
+        check_account_balance: Permission.READ,
+        get_transaction_list: Permission.READ,
+        request_consent: Permission.WRITE,
+        fetch_fi_data: Permission.READ,
+    },
+});
+//# sourceMappingURL=banking_aa.js.map

package/dist/manifests/banking_aa.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"banking_aa.js","sourceRoot":"","sources":["../../src/manifests/banking_aa.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAE1D,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,YAAY,CAAC;IAChD,SAAS,EAAE,YAAY;IACvB,WAAW,EAAE,gCAAgC;IAC7C,KAAK,EAAE;QACL,oBAAoB,EAAE,UAAU,CAAC,IAAI;QACrC,qBAAqB,EAAE,UAAU,CAAC,IAAI;QACtC,oBAAoB,EAAE,UAAU,CAAC,IAAI;QACrC,eAAe,EAAE,UAAU,CAAC,KAAK;QACjC,aAAa,EAAE,UAAU,CAAC,IAAI;KAC/B;CACF,CAAC,CAAC"}

package/dist/manifests/bombora.d.ts

@@ -0,0 +1,3 @@
+import { ToolManifest } from '../manifest.js';
+export declare const bomboraManifest: ToolManifest;
+//# sourceMappingURL=bombora.d.ts.map

package/dist/manifests/bombora.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bombora.d.ts","sourceRoot":"","sources":["../../src/manifests/bombora.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAc,MAAM,gBAAgB,CAAC;AAE1D,eAAO,MAAM,eAAe,cAS1B,CAAC"}

package/dist/manifests/bombora.js

@@ -0,0 +1,12 @@
+import { ToolManifest, Permission } from '../manifest.js';
+export const bomboraManifest = new ToolManifest({
+    connector: 'bombora',
+    description: 'Bombora Intent Data API',
+    tools: {
+        get_surge_scores: Permission.READ,
+        get_topic_clusters: Permission.READ,
+        get_weekly_report: Permission.READ,
+        search_companies: Permission.READ,
+    },
+});
+//# sourceMappingURL=bombora.js.map

package/dist/manifests/bombora.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bombora.js","sourceRoot":"","sources":["../../src/manifests/bombora.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAE1D,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,YAAY,CAAC;IAC9C,SAAS,EAAE,SAAS;IACpB,WAAW,EAAE,yBAAyB;IACtC,KAAK,EAAE;QACL,gBAAgB,EAAE,UAAU,CAAC,IAAI;QACjC,kBAAkB,EAAE,UAAU,CAAC,IAAI;QACnC,iBAAiB,EAAE,UAAU,CAAC,IAAI;QAClC,gBAAgB,EAAE,UAAU,CAAC,IAAI;KAClC;CACF,CAAC,CAAC"}

package/dist/manifests/brandwatch.d.ts

@@ -0,0 +1,3 @@
+import { ToolManifest } from '../manifest.js';
+export declare const brandwatchManifest: ToolManifest;
+//# sourceMappingURL=brandwatch.d.ts.map

package/dist/manifests/brandwatch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"brandwatch.d.ts","sourceRoot":"","sources":["../../src/manifests/brandwatch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAc,MAAM,gBAAgB,CAAC;AAE1D,eAAO,MAAM,kBAAkB,cAU7B,CAAC"}

package/dist/manifests/brandwatch.js

@@ -0,0 +1,13 @@
+import { ToolManifest, Permission } from '../manifest.js';
+export const brandwatchManifest = new ToolManifest({
+    connector: 'brandwatch',
+    description: 'Brandwatch Social Listening API',
+    tools: {
+        get_mentions: Permission.READ,
+        get_mention_summary: Permission.READ,
+        get_share_of_voice: Permission.READ,
+        create_alert: Permission.WRITE,
+        export_report: Permission.READ,
+    },
+});
+//# sourceMappingURL=brandwatch.js.map