@grantex/sdk 0.2.6 → 0.3.1

package/dist/client.d.ts

@@ -18,6 +18,7 @@ import { DomainsClient } from './resources/domains.js';
 import { WebAuthnClient } from './resources/webauthn.js';
 import { CredentialsClient } from './resources/credentials.js';
 import { PassportsClient } from './resources/passports.js';
+import { ToolManifest, type EnforceOptions, type EnforceResult, type WrapToolOptions, type EnforceMiddlewareOptions } from './manifest.js';
 import type { AuthorizationRequest, AuthorizeParams, GrantexClientOptions, RateLimit, RotateKeyResponse, SignupParams, SignupResponse, UpdateDeveloperSettingsParams, UpdateDeveloperSettingsResponse } from './types.js';
 export declare class Grantex {
     #private;
@@ -63,5 +64,69 @@ export declare class Grantex {
      * Update developer settings (e.g. FIDO/WebAuthn requirements).
      */
     updateSettings(params: UpdateDeveloperSettingsParams): Promise<UpdateDeveloperSettingsResponse>;
+    /**
+     * Load a tool manifest for scope enforcement.
+     * Manifests define what permission level each tool requires.
+     */
+    loadManifest(manifest: ToolManifest): void;
+    /**
+     * Load multiple tool manifests at once.
+     */
+    loadManifests(manifests: ToolManifest[]): void;
+    /**
+     * Enforce scope for a tool call.
+     *
+     * 1. Verifies the grant token JWT offline (JWKS cached, <1ms after first call)
+     * 2. Looks up the tool's required permission from loaded manifests
+     * 3. Checks if the granted scope level covers the required permission
+     *
+     * Fails closed: unknown connectors/tools are denied by default.
+     *
+     * @example
+     * ```ts
+     * const result = await grantex.enforce({
+     *   grantToken: token,
+     *   connector: 'salesforce',
+     *   tool: 'delete_contact',
+     * });
+     * if (!result.allowed) throw new Error(result.reason);
+     * ```
+     */
+    enforce(options: EnforceOptions): Promise<EnforceResult>;
+    /**
+     * Wrap a LangChain StructuredTool with automatic Grantex scope enforcement.
+     * Before each tool invocation, the grant token is verified and scopes are checked.
+     *
+     * @param tool - The LangChain StructuredTool to wrap
+     * @param options - Connector name, tool name, and grant token (string or getter function)
+     * @returns A new StructuredTool that enforces scopes before calling the original
+     *
+     * @example
+     * ```ts
+     * const protectedTool = grantex.wrapTool(myTool, {
+     *   connector: 'salesforce',
+     *   tool: 'create_lead',
+     *   grantToken: () => currentState.grant_token,
+     * });
+     * ```
+     */
+    wrapTool<T extends {
+        name: string;
+        description: string;
+        invoke: (...args: unknown[]) => Promise<unknown>;
+    }>(tool: T, options: WrapToolOptions): T;
+    /**
+     * Create Express/Fastify middleware that enforces Grantex scopes on every request.
+     *
+     * @example
+     * ```ts
+     * app.use('/api/tools/*', grantex.enforceMiddleware({
+     *   extractToken: (req) => req.headers.authorization?.replace('Bearer ', ''),
+     *   extractConnector: (req) => req.params.connector,
+     *   extractTool: (req) => req.params.tool,
+     * }));
+     * ```
+     */
+    enforceMiddleware(options: EnforceMiddlewareOptions): (req: unknown, res: unknown, next: unknown) => void;
 }
 //# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,uBAAuB,EAAE,MAAM,mCAAmC,CAAC;AAC5E,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,KAAK,EACV,oBAAoB,EACpB,eAAe,EACf,oBAAoB,EACpB,SAAS,EACT,iBAAiB,EACjB,YAAY,EACZ,cAAc,EACd,6BAA6B,EAC7B,+BAA+B,EAChC,MAAM,YAAY,CAAC;AAIpB,qBAAa,OAAO;;IAGlB,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IACtC,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IACpC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;IACxB,QAAQ,CAAC,iBAAiB,EAAE,uBAAuB,CAAC;IACpD,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAC;IACxC,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IAEpC,IAAI,aAAa,IAAI,SAAS,GAAG,SAAS,CAEzC;gBAEW,OAAO,GAAE,oBAAyB;IAsC9C;;;OAGG;WACU,MAAM,CACjB,MAAM,EAAE,YAAY,EACpB,OAAO,GAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAO,GACjC,OAAO,CAAC,cAAc,CAAC;IAuB1B;;;OAGG;IACH,SAAS,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAQjE;;OAEG;IACH,SAAS,IAAI,OAAO,CAAC,iBAAiB,CAAC;IAIvC;;OAEG;IACH,cAAc,CAAC,MAAM,EAAE,6BAA6B,GAAG,OAAO,CAAC,+BAA+B,CAAC;CAGhG"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,uBAAuB,EAAE,MAAM,mCAAmC,CAAC;AAC5E,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAgC,KAAK,cAAc,EAAE,KAAK,aAAa,EAAE,KAAK,eAAe,EAAE,KAAK,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAEzK,OAAO,KAAK,EACV,oBAAoB,EACpB,eAAe,EACf,oBAAoB,EACpB,SAAS,EACT,iBAAiB,EACjB,YAAY,EACZ,cAAc,EACd,6BAA6B,EAC7B,+BAA+B,EAEhC,MAAM,YAAY,CAAC;AAIpB,qBAAa,OAAO;;IAMlB,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IACtC,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IACpC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;IACxB,QAAQ,CAAC,iBAAiB,EAAE,uBAAuB,CAAC;IACpD,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAC;IACxC,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IAEpC,IAAI,aAAa,IAAI,SAAS,GAAG,SAAS,CAEzC;gBAEW,OAAO,GAAE,oBAAyB;IAwC9C;;;OAGG;WACU,MAAM,CACjB,MAAM,EAAE,YAAY,EACpB,OAAO,GAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAO,GACjC,OAAO,CAAC,cAAc,CAAC;IAuB1B;;;OAGG;IACH,SAAS,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAQjE;;OAEG;IACH,SAAS,IAAI,OAAO,CAAC,iBAAiB,CAAC;IAIvC;;OAEG;IACH,cAAc,CAAC,MAAM,EAAE,6BAA6B,GAAG,OAAO,CAAC,+BAA+B,CAAC;IAI/F;;;OAGG;IACH,YAAY,CAAC,QAAQ,EAAE,YAAY,GAAG,IAAI;IAI1C;;OAEG;IACH,aAAa,CAAC,SAAS,EAAE,YAAY,EAAE,GAAG,IAAI;IAM9C;;;;;;;;;;;;;;;;;;OAkBG;IACG,OAAO,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;IA4I9D;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,CAAC,SAAS;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;KAAE,EACxG,IAAI,EAAE,CAAC,EACP,OAAO,EAAE,eAAe,GACvB,CAAC;IA0BJ;;;;;;;;;;;OAWG;IACH,iBAAiB,CAAC,OAAO,EAAE,wBAAwB,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,KAAK,IAAI;CAmC1G"}

package/dist/client.js

@@ -19,9 +19,14 @@ import { DomainsClient } from './resources/domains.js';
 import { WebAuthnClient } from './resources/webauthn.js';
 import { CredentialsClient } from './resources/credentials.js';
 import { PassportsClient } from './resources/passports.js';
+import { permissionCovers } from './manifest.js';
+import { verifyGrantToken } from './verify.js';
 const DEFAULT_BASE_URL = 'https://api.grantex.dev';
 export class Grantex {
     #http;
+    #manifests = new Map();
+    #jwksUri;
+    #enforceMode;
     agents;
     grants;
     tokens;
@@ -75,6 +80,8 @@ export class Grantex {
         this.webauthn = new WebAuthnClient(this.#http);
         this.credentials = new CredentialsClient(this.#http);
         this.passports = new PassportsClient(this.#http);
+        this.#jwksUri = `${(options.baseUrl ?? DEFAULT_BASE_URL).replace(/\/$/, '')}/.well-known/jwks.json`;
+        this.#enforceMode = options['enforceMode'] ?? 'strict';
     }
     /**
      * Create a new developer account without an API key.
@@ -122,5 +129,246 @@ export class Grantex {
     updateSettings(params) {
         return this.#http.patch('/v1/me', params);
     }
+    /**
+     * Load a tool manifest for scope enforcement.
+     * Manifests define what permission level each tool requires.
+     */
+    loadManifest(manifest) {
+        this.#manifests.set(manifest.connector, manifest);
+    }
+    /**
+     * Load multiple tool manifests at once.
+     */
+    loadManifests(manifests) {
+        for (const m of manifests) {
+            this.#manifests.set(m.connector, m);
+        }
+    }
+    /**
+     * Enforce scope for a tool call.
+     *
+     * 1. Verifies the grant token JWT offline (JWKS cached, <1ms after first call)
+     * 2. Looks up the tool's required permission from loaded manifests
+     * 3. Checks if the granted scope level covers the required permission
+     *
+     * Fails closed: unknown connectors/tools are denied by default.
+     *
+     * @example
+     * ```ts
+     * const result = await grantex.enforce({
+     *   grantToken: token,
+     *   connector: 'salesforce',
+     *   tool: 'delete_contact',
+     * });
+     * if (!result.allowed) throw new Error(result.reason);
+     * ```
+     */
+    async enforce(options) {
+        const { grantToken, connector, tool, amount } = options;
+        const base = {
+            grantId: '',
+            agentDid: '',
+            scopes: [],
+            permission: '',
+            connector,
+            tool,
+        };
+        // 1. Verify the token offline via JWKS
+        let grant;
+        try {
+            grant = await verifyGrantToken(grantToken, { jwksUri: this.#jwksUri });
+        }
+        catch (err) {
+            return this.#applyEnforceMode({
+                ...base,
+                allowed: false,
+                reason: `Token verification failed: ${err instanceof Error ? err.message : String(err)}`,
+            });
+        }
+        base.grantId = grant.grantId;
+        base.agentDid = grant.agentDid;
+        base.scopes = grant.scopes;
+        // 2. Look up manifest for the connector
+        const manifest = this.#manifests.get(connector);
+        if (!manifest) {
+            return this.#applyEnforceMode({
+                ...base,
+                allowed: false,
+                reason: `No manifest loaded for connector '${connector}'. Load a manifest first.`,
+            });
+        }
+        // 3. Look up tool permission from manifest
+        const requiredPermission = manifest.getPermission(tool);
+        if (!requiredPermission) {
+            return this.#applyEnforceMode({
+                ...base,
+                allowed: false,
+                reason: `Unknown tool '${tool}' on connector '${connector}'. Tool not found in manifest.`,
+            });
+        }
+        base.permission = requiredPermission;
+        // 4. Find the best matching scope for this connector
+        const grantedPermission = this.#resolveGrantedPermission(grant.scopes, connector);
+        if (!grantedPermission) {
+            return this.#applyEnforceMode({
+                ...base,
+                allowed: false,
+                reason: `No scope grants access to connector '${connector}'.`,
+            });
+        }
+        // 5. Check permission hierarchy
+        if (!permissionCovers(grantedPermission, requiredPermission)) {
+            return this.#applyEnforceMode({
+                ...base,
+                allowed: false,
+                reason: `${grantedPermission} scope does not permit ${requiredPermission} operations on ${connector}.`,
+            });
+        }
+        // 6. Check capped amount if provided
+        if (amount !== undefined) {
+            const cap = this.#extractCap(grant.scopes, connector);
+            if (cap !== undefined && amount > cap) {
+                return this.#applyEnforceMode({
+                    ...base,
+                    allowed: false,
+                    reason: `Amount ${amount} exceeds budget cap of ${cap} on ${connector}.`,
+                });
+            }
+        }
+        return { ...base, allowed: true, reason: '' };
+    }
+    /**
+     * Resolve the highest granted permission level for a connector from scope strings.
+     * Scope format: `tool:{connector}:{permission}[:{resource}][:capped:{N}]`
+     */
+    #resolveGrantedPermission(scopes, connector) {
+        let best;
+        let bestLevel = -1;
+        const levels = { read: 0, write: 1, delete: 2, admin: 3 };
+        for (const scope of scopes) {
+            const parts = scope.split(':');
+            // Match: tool:{connector}:{permission}:...
+            if (parts[0] === 'tool' && parts[1] === connector && parts[2]) {
+                const level = levels[parts[2]] ?? -1;
+                if (level > bestLevel) {
+                    bestLevel = level;
+                    best = parts[2];
+                }
+            }
+            // Also match agenticorg:{connector}:{permission}
+            if (parts[0] === 'agenticorg' && parts[1] === connector && parts[2]) {
+                const level = levels[parts[2]] ?? -1;
+                if (level > bestLevel) {
+                    bestLevel = level;
+                    best = parts[2];
+                }
+            }
+        }
+        return best;
+    }
+    /**
+     * Extract the budget cap from capped scopes for a connector.
+     * Scope format: `tool:{connector}:{permission}:{resource}:capped:{N}`
+     */
+    #extractCap(scopes, connector) {
+        for (const scope of scopes) {
+            const parts = scope.split(':');
+            if (parts[0] === 'tool' && parts[1] === connector) {
+                const cappedIdx = parts.indexOf('capped');
+                if (cappedIdx !== -1 && parts[cappedIdx + 1]) {
+                    return Number(parts[cappedIdx + 1]);
+                }
+            }
+        }
+        return undefined;
+    }
+    #applyEnforceMode(result) {
+        if (!result.allowed && this.#enforceMode === 'permissive') {
+            console.warn(`[grantex] PERMISSIVE MODE — would deny: ${result.reason} (connector=${result.connector}, tool=${result.tool})`);
+            return { ...result, allowed: true };
+        }
+        return result;
+    }
+    /**
+     * Wrap a LangChain StructuredTool with automatic Grantex scope enforcement.
+     * Before each tool invocation, the grant token is verified and scopes are checked.
+     *
+     * @param tool - The LangChain StructuredTool to wrap
+     * @param options - Connector name, tool name, and grant token (string or getter function)
+     * @returns A new StructuredTool that enforces scopes before calling the original
+     *
+     * @example
+     * ```ts
+     * const protectedTool = grantex.wrapTool(myTool, {
+     *   connector: 'salesforce',
+     *   tool: 'create_lead',
+     *   grantToken: () => currentState.grant_token,
+     * });
+     * ```
+     */
+    wrapTool(tool, options) {
+        const self = this;
+        const originalInvoke = tool.invoke.bind(tool);
+        const wrapped = Object.create(tool);
+        wrapped.invoke = async function (...args) {
+            const token = typeof options.grantToken === 'function'
+                ? options.grantToken()
+                : options.grantToken;
+            const result = await self.enforce({
+                grantToken: token,
+                connector: options.connector,
+                tool: options.tool,
+            });
+            if (!result.allowed) {
+                throw new Error(`Grantex scope denied: ${result.reason}`);
+            }
+            return originalInvoke(...args);
+        };
+        return wrapped;
+    }
+    /**
+     * Create Express/Fastify middleware that enforces Grantex scopes on every request.
+     *
+     * @example
+     * ```ts
+     * app.use('/api/tools/*', grantex.enforceMiddleware({
+     *   extractToken: (req) => req.headers.authorization?.replace('Bearer ', ''),
+     *   extractConnector: (req) => req.params.connector,
+     *   extractTool: (req) => req.params.tool,
+     * }));
+     * ```
+     */
+    enforceMiddleware(options) {
+        const self = this;
+        return function grantexEnforce(req, res, next) {
+            const request = req;
+            const response = res;
+            const nextFn = next;
+            const token = options.extractToken(request);
+            const connector = options.extractConnector(request);
+            const tool = options.extractTool(request);
+            if (!token) {
+                const statusFn = response['status'];
+                const jsonFn = statusFn.call(response, 401)['json'];
+                jsonFn.call(statusFn.call(response, 401), { error: { code: 'UNAUTHORIZED', message: 'Missing grant token' } });
+                return;
+            }
+            self.enforce({ grantToken: token, connector, tool })
+                .then((result) => {
+                if (!result.allowed) {
+                    const statusFn = response['status'];
+                    const jsonFn = statusFn.call(response, 403)['json'];
+                    jsonFn.call(statusFn.call(response, 403), {
+                        error: { code: 'SCOPE_DENIED', message: result.reason, connector, tool },
+                    });
+                    return;
+                }
+                // Attach enforce result to request for downstream use
+                request['grantexEnforce'] = result;
+                nextFn();
+            })
+                .catch((err) => nextFn(err));
+        };
+    }
 }
 //# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,uBAAuB,EAAE,MAAM,mCAAmC,CAAC;AAC5E,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAa3D,MAAM,gBAAgB,GAAG,yBAAyB,CAAC;AAEnD,MAAM,OAAO,OAAO;IACT,KAAK,CAAa;IAElB,MAAM,CAAe;IACrB,MAAM,CAAe;IACrB,MAAM,CAAe;IACrB,KAAK,CAAc;IACnB,QAAQ,CAAiB;IACzB,OAAO,CAAgB;IACvB,QAAQ,CAAiB;IACzB,UAAU,CAAmB;IAC7B,SAAS,CAAkB;IAC3B,IAAI,CAAa;IACjB,GAAG,CAAY;IACf,iBAAiB,CAA0B;IAC3C,KAAK,CAAc;IACnB,OAAO,CAAgB;IACvB,MAAM,CAAe;IACrB,KAAK,CAAc;IACnB,OAAO,CAAgB;IACvB,QAAQ,CAAiB;IACzB,WAAW,CAAoB;IAC/B,SAAS,CAAkB;IAEpC,IAAI,aAAa;QACf,OAAO,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC;IAClC,CAAC;IAED,YAAY,UAAgC,EAAE;QAC5C,MAAM,MAAM,GACV,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC;QAEzD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CACb,wGAAwG,CACzG,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,KAAK,GAAG,IAAI,UAAU,CAAC;YAC1B,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,gBAAgB;YAC5C,MAAM;YACN,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvE,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,CAAC,KAAK,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,CAAC,QAAQ,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/C,IAAI,CAAC,OAAO,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,CAAC,QAAQ,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/C,IAAI,CAAC,UAAU,GAAG,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnD,IAAI,CAAC,SAAS,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,CAAC,GAAG,GAAG,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,CAAC,iBAAiB,GAAG,IAAI,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjE,IAAI,CAAC,KAAK,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,IAAI,gBAAgB,CAAC,CAAC;QAC9E,IAAI,CAAC,OAAO,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,CAAC,KAAK,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,CAAC,OAAO,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,CAAC,QAAQ,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/C,IAAI,CAAC,WAAW,GAAG,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrD,IAAI,CAAC,SAAS,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnD,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,KAAK,CAAC,MAAM,CACjB,MAAoB,EACpB,UAAgC,EAAE;QAElC,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,gBAAgB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACzE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,YAAY,EAAE;YACnD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,MAAM,EAAE,kBAAkB;aAC3B;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;SAC7B,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;YACrD,MAAM,OAAO,GACX,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,SAAS,IAAI,IAAI;gBACnD,CAAC,CAAC,MAAM,CAAE,IAAgC,CAAC,SAAS,CAAC,CAAC;gBACtD,CAAC,CAAC,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;QAC3B,CAAC;QAED,OAAO,QAAQ,CAAC,IAAI,EAA6B,CAAC;IACpD,CAAC;IAED;;;OAGG;IACH,SAAS,CAAC,MAAuB;QAC/B,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC;QACnC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAuB,eAAe,EAAE;YAC5D,GAAG,IAAI;YACP,WAAW,EAAE,MAAM;SACpB,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,SAAS;QACP,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAoB,iBAAiB,CAAC,CAAC;IAC/D,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,MAAqC;QAClD,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAkC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC7E,CAAC;CACF"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,uBAAuB,EAAE,MAAM,mCAAmC,CAAC;AAC5E,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAA4B,gBAAgB,EAAgG,MAAM,eAAe,CAAC;AACzK,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAc/C,MAAM,gBAAgB,GAAG,yBAAyB,CAAC;AAEnD,MAAM,OAAO,OAAO;IACT,KAAK,CAAa;IAClB,UAAU,GAA8B,IAAI,GAAG,EAAE,CAAC;IAC3D,QAAQ,CAAS;IACjB,YAAY,CAA0B;IAE7B,MAAM,CAAe;IACrB,MAAM,CAAe;IACrB,MAAM,CAAe;IACrB,KAAK,CAAc;IACnB,QAAQ,CAAiB;IACzB,OAAO,CAAgB;IACvB,QAAQ,CAAiB;IACzB,UAAU,CAAmB;IAC7B,SAAS,CAAkB;IAC3B,IAAI,CAAa;IACjB,GAAG,CAAY;IACf,iBAAiB,CAA0B;IAC3C,KAAK,CAAc;IACnB,OAAO,CAAgB;IACvB,MAAM,CAAe;IACrB,KAAK,CAAc;IACnB,OAAO,CAAgB;IACvB,QAAQ,CAAiB;IACzB,WAAW,CAAoB;IAC/B,SAAS,CAAkB;IAEpC,IAAI,aAAa;QACf,OAAO,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC;IAClC,CAAC;IAED,YAAY,UAAgC,EAAE;QAC5C,MAAM,MAAM,GACV,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC;QAEzD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CACb,wGAAwG,CACzG,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,KAAK,GAAG,IAAI,UAAU,CAAC;YAC1B,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,gBAAgB;YAC5C,MAAM;YACN,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvE,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,CAAC,KAAK,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,CAAC,QAAQ,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/C,IAAI,CAAC,OAAO,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,CAAC,QAAQ,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/C,IAAI,CAAC,UAAU,GAAG,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnD,IAAI,CAAC,SAAS,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,CAAC,GAAG,GAAG,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,CAAC,iBAAiB,GAAG,IAAI,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjE,IAAI,CAAC,KAAK,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,IAAI,gBAAgB,CAAC,CAAC;QAC9E,IAAI,CAAC,OAAO,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,CAAC,KAAK,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,CAAC,OAAO,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,CAAC,QAAQ,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/C,IAAI,CAAC,WAAW,GAAG,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrD,IAAI,CAAC,SAAS,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjD,IAAI,CAAC,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,gBAAgB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,wBAAwB,CAAC;QACpG,IAAI,CAAC,YAAY,GAAI,OAAmC,CAAC,aAAa,CAA4B,IAAI,QAAQ,CAAC;IACjH,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,KAAK,CAAC,MAAM,CACjB,MAAoB,EACpB,UAAgC,EAAE;QAElC,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,gBAAgB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACzE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,YAAY,EAAE;YACnD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,MAAM,EAAE,kBAAkB;aAC3B;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;SAC7B,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;YACrD,MAAM,OAAO,GACX,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,SAAS,IAAI,IAAI;gBACnD,CAAC,CAAC,MAAM,CAAE,IAAgC,CAAC,SAAS,CAAC,CAAC;gBACtD,CAAC,CAAC,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;QAC3B,CAAC;QAED,OAAO,QAAQ,CAAC,IAAI,EAA6B,CAAC;IACpD,CAAC;IAED;;;OAGG;IACH,SAAS,CAAC,MAAuB;QAC/B,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC;QACnC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAuB,eAAe,EAAE;YAC5D,GAAG,IAAI;YACP,WAAW,EAAE,MAAM;SACpB,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,SAAS;QACP,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAoB,iBAAiB,CAAC,CAAC;IAC/D,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,MAAqC;QAClD,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAkC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC7E,CAAC;IAED;;;OAGG;IACH,YAAY,CAAC,QAAsB;QACjC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACpD,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,SAAyB;QACrC,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;YAC1B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,KAAK,CAAC,OAAO,CAAC,OAAuB;QACnC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;QACxD,MAAM,IAAI,GAA8C;YACtD,OAAO,EAAE,EAAE;YACX,QAAQ,EAAE,EAAE;YACZ,MAAM,EAAE,EAAE;YACV,UAAU,EAAE,EAAE;YACd,SAAS;YACT,IAAI;SACL,CAAC;QAEF,uCAAuC;QACvC,IAAI,KAAoB,CAAC;QACzB,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,gBAAgB,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QACzE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,iBAAiB,CAAC;gBAC5B,GAAG,IAAI;gBACP,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,8BAA8B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;aACzF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;QAC7B,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;QAC/B,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QAE3B,wCAAwC;QACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAChD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,IAAI,CAAC,iBAAiB,CAAC;gBAC5B,GAAG,IAAI;gBACP,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,qCAAqC,SAAS,2BAA2B;aAClF,CAAC,CAAC;QACL,CAAC;QAED,2CAA2C;QAC3C,MAAM,kBAAkB,GAAG,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QACxD,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC,iBAAiB,CAAC;gBAC5B,GAAG,IAAI;gBACP,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,iBAAiB,IAAI,mBAAmB,SAAS,gCAAgC;aAC1F,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,UAAU,GAAG,kBAAkB,CAAC;QAErC,qDAAqD;QACrD,MAAM,iBAAiB,GAAG,IAAI,CAAC,yBAAyB,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAClF,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC,iBAAiB,CAAC;gBAC5B,GAAG,IAAI;gBACP,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,wCAAwC,SAAS,IAAI;aAC9D,CAAC,CAAC;QACL,CAAC;QAED,gCAAgC;QAChC,IAAI,CAAC,gBAAgB,CAAC,iBAAiB,EAAE,kBAAkB,CAAC,EAAE,CAAC;YAC7D,OAAO,IAAI,CAAC,iBAAiB,CAAC;gBAC5B,GAAG,IAAI;gBACP,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,GAAG,iBAAiB,0BAA0B,kBAAkB,kBAAkB,SAAS,GAAG;aACvG,CAAC,CAAC;QACL,CAAC;QAED,qCAAqC;QACrC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YACtD,IAAI,GAAG,KAAK,SAAS,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;gBACtC,OAAO,IAAI,CAAC,iBAAiB,CAAC;oBAC5B,GAAG,IAAI;oBACP,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,UAAU,MAAM,0BAA0B,GAAG,OAAO,SAAS,GAAG;iBACzE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAChD,CAAC;IAED;;;OAGG;IACH,yBAAyB,CAAC,MAAgB,EAAE,SAAiB;QAC3D,IAAI,IAAwB,CAAC;QAC7B,IAAI,SAAS,GAAG,CAAC,CAAC,CAAC;QAEnB,MAAM,MAAM,GAA2B,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QAElF,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC/B,2CAA2C;YAC3C,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9D,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;gBACrC,IAAI,KAAK,GAAG,SAAS,EAAE,CAAC;oBACtB,SAAS,GAAG,KAAK,CAAC;oBAClB,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBAClB,CAAC;YACH,CAAC;YACD,iDAAiD;YACjD,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,YAAY,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpE,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;gBACrC,IAAI,KAAK,GAAG,SAAS,EAAE,CAAC;oBACtB,SAAS,GAAG,KAAK,CAAC;oBAClB,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBAClB,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;OAGG;IACH,WAAW,CAAC,MAAgB,EAAE,SAAiB;QAC7C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;gBAClD,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;gBAC1C,IAAI,SAAS,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,EAAE,CAAC;oBAC7C,OAAO,MAAM,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC;gBACtC,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,iBAAiB,CAAC,MAAqB;QACrC,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,YAAY,KAAK,YAAY,EAAE,CAAC;YAC1D,OAAO,CAAC,IAAI,CAAC,2CAA2C,MAAM,CAAC,MAAM,eAAe,MAAM,CAAC,SAAS,UAAU,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC;YAC9H,OAAO,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACtC,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CACN,IAAO,EACP,OAAwB;QAExB,MAAM,IAAI,GAAG,IAAI,CAAC;QAClB,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAE9C,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACpC,OAAO,CAAC,MAAM,GAAG,KAAK,WAAW,GAAG,IAAe;YACjD,MAAM,KAAK,GAAG,OAAO,OAAO,CAAC,UAAU,KAAK,UAAU;gBACpD,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE;gBACtB,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;YAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC;gBAChC,UAAU,EAAE,KAAK;gBACjB,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,IAAI,EAAE,OAAO,CAAC,IAAI;aACnB,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,MAAM,IAAI,KAAK,CAAC,yBAAyB,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;YAC5D,CAAC;YAED,OAAO,cAAc,CAAC,GAAG,IAAI,CAAC,CAAC;QACjC,CAAC,CAAC;QAEF,OAAO,OAAY,CAAC;IACtB,CAAC;IAED;;;;;;;;;;;OAWG;IACH,iBAAiB,CAAC,OAAiC;QACjD,MAAM,IAAI,GAAG,IAAI,CAAC;QAClB,OAAO,SAAS,cAAc,CAAC,GAAY,EAAE,GAAY,EAAE,IAAa;YACtE,MAAM,OAAO,GAAG,GAA8B,CAAC;YAC/C,MAAM,QAAQ,GAAG,GAA8B,CAAC;YAChD,MAAM,MAAM,GAAG,IAA+B,CAAC;YAE/C,MAAM,KAAK,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;YAC5C,MAAM,SAAS,GAAG,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;YACpD,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;YAE1C,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAA8C,CAAC;gBACjF,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAA4B,CAAC;gBAC/E,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,qBAAqB,EAAE,EAAE,CAAC,CAAC;gBAC/G,OAAO;YACT,CAAC;YAED,IAAI,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;iBACjD,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;gBACf,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;oBACpB,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAA8C,CAAC;oBACjF,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAA4B,CAAC;oBAC/E,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE;wBACxC,KAAK,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE;qBACzE,CAAC,CAAC;oBACH,OAAO;gBACT,CAAC;gBACD,sDAAsD;gBACrD,OAAmC,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAAC;gBAChE,MAAM,EAAE,CAAC;YACX,CAAC,CAAC;iBACD,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACjC,CAAC,CAAC;IACJ,CAAC;CACF"}

package/dist/index.d.ts

@@ -5,5 +5,6 @@ export { generatePkce, type PkceChallenge } from './pkce.js';
 export { GrantexError, GrantexApiError, GrantexAuthError, GrantexTokenError, GrantexNetworkError, } from './errors.js';
 export { EventsClient, type GrantexEvent as GrantexStreamEvent, type StreamOptions, type EventHandler } from './resources/events.js';
 export { PassportsClient, type IssuePassportParams, type IssuedPassportResponse, type GetPassportResponse, type RevokePassportResponse, type ListPassportsParams, } from './resources/passports.js';
+export { ToolManifest, Permission, permissionCovers, type EnforceOptions, type EnforceResult, type ToolManifestOptions, type WrapToolOptions, type EnforceMiddlewareOptions } from './manifest.js';
 export type { RateLimit, GrantexClientOptions, SignupParams, SignupResponse, RotateKeyResponse, Agent, RegisterAgentParams, UpdateAgentParams, ListAgentsResponse, AuthorizeParams, AuthorizationRequest, Grant, ListGrantsParams, ListGrantsResponse, VerifiedGrant, DelegateParams, ExchangeTokenParams, ExchangeTokenResponse, RefreshTokenParams, VerifyTokenResponse, CreatePrincipalSessionParams, PrincipalSessionResponse, LogAuditParams, AuditEntry, ListAuditParams, ListAuditResponse, VerifyGrantTokenOptions, WebhookEventType, CreateWebhookParams, WebhookEndpoint, WebhookEndpointWithSecret, ListWebhooksResponse, SubscriptionStatus, CreateCheckoutParams, CheckoutResponse, CreatePortalParams, PortalResponse, Policy, CreatePolicyParams, UpdatePolicyParams, ListPoliciesResponse, AnomalyType, AnomalySeverity, Anomaly, DetectAnomaliesResponse, ListAnomaliesResponse, ScimEmail, ScimUserMeta, ScimUser, ScimListResponse, CreateScimUserParams, UpdateScimUserParams, ScimToken, ScimTokenWithSecret, CreateScimTokenParams, ListScimTokensResponse, SsoConfig, CreateSsoConfigParams, SsoLoginResponse, SsoCallbackResponse, StoreCredentialParams, StoreCredentialResponse, VaultCredential, ListVaultCredentialsParams, ListVaultCredentialsResponse, ExchangeCredentialParams, ExchangeCredentialResponse, AllocateBudgetParams, BudgetAllocation, DebitBudgetParams, DebitBudgetResponse, BudgetTransaction, BudgetTransactionsResponse, ComplianceSummary, ComplianceExportGrantsParams, ComplianceExportAuditParams, ComplianceGrantsExport, ComplianceAuditExport, EvidencePackParams, EvidencePack, ChainIntegrity, UsageResponse, UsageHistoryEntry, UsageHistoryResponse, CreateDomainParams, CreateDomainResponse, DomainEntry, ListDomainsResponse, VerifyDomainResponse, WebAuthnRegistrationOptions, WebAuthnRegistrationVerifyParams, WebAuthnCredential, ListWebAuthnCredentialsResponse, VerifiableCredentialRecord, ListCredentialsParams, ListCredentialsResponse, VCVerificationResult, SDJWTPresentParams, SDJWTPresentResult, UpdateDeveloperSettingsParams, UpdateDeveloperSettingsResponse, } from './types.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAGtC,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAG/C,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAGtD,OAAO,EAAE,YAAY,EAAE,KAAK,aAAa,EAAE,MAAM,WAAW,CAAC;AAG7D,OAAO,EACL,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,aAAa,CAAC;AAGrB,OAAO,EAAE,YAAY,EAAE,KAAK,YAAY,IAAI,kBAAkB,EAAE,KAAK,aAAa,EAAE,KAAK,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAGrI,OAAO,EACL,eAAe,EACf,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,GACzB,MAAM,0BAA0B,CAAC;AAGlC,YAAY,EACV,SAAS,EACT,oBAAoB,EAEpB,YAAY,EACZ,cAAc,EACd,iBAAiB,EAEjB,KAAK,EACL,mBAAmB,EACnB,iBAAiB,EACjB,kBAAkB,EAElB,eAAe,EACf,oBAAoB,EAEpB,KAAK,EACL,gBAAgB,EAChB,kBAAkB,EAClB,aAAa,EACb,cAAc,EAEd,mBAAmB,EACnB,qBAAqB,EACrB,kBAAkB,EAClB,mBAAmB,EAEnB,4BAA4B,EAC5B,wBAAwB,EAExB,cAAc,EACd,UAAU,EACV,eAAe,EACf,iBAAiB,EAEjB,uBAAuB,EAEvB,gBAAgB,EAChB,mBAAmB,EACnB,eAAe,EACf,yBAAyB,EACzB,oBAAoB,EAEpB,kBAAkB,EAClB,oBAAoB,EACpB,gBAAgB,EAChB,kBAAkB,EAClB,cAAc,EAEd,MAAM,EACN,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EAEpB,WAAW,EACX,eAAe,EACf,OAAO,EACP,uBAAuB,EACvB,qBAAqB,EAErB,SAAS,EACT,YAAY,EACZ,QAAQ,EACR,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,EACpB,SAAS,EACT,mBAAmB,EACnB,qBAAqB,EACrB,sBAAsB,EAEtB,SAAS,EACT,qBAAqB,EACrB,gBAAgB,EAChB,mBAAmB,EAEnB,qBAAqB,EACrB,uBAAuB,EACvB,eAAe,EACf,0BAA0B,EAC1B,4BAA4B,EAC5B,wBAAwB,EACxB,0BAA0B,EAE1B,oBAAoB,EACpB,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,0BAA0B,EAE1B,iBAAiB,EACjB,4BAA4B,EAC5B,2BAA2B,EAC3B,sBAAsB,EACtB,qBAAqB,EACrB,kBAAkB,EAClB,YAAY,EACZ,cAAc,EAEd,aAAa,EACb,iBAAiB,EACjB,oBAAoB,EAEpB,kBAAkB,EAClB,oBAAoB,EACpB,WAAW,EACX,mBAAmB,EACnB,oBAAoB,EAEpB,2BAA2B,EAC3B,gCAAgC,EAChC,kBAAkB,EAClB,+BAA+B,EAE/B,0BAA0B,EAC1B,qBAAqB,EACrB,uBAAuB,EACvB,oBAAoB,EAEpB,kBAAkB,EAClB,kBAAkB,EAElB,6BAA6B,EAC7B,+BAA+B,GAChC,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAGtC,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAG/C,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAGtD,OAAO,EAAE,YAAY,EAAE,KAAK,aAAa,EAAE,MAAM,WAAW,CAAC;AAG7D,OAAO,EACL,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,aAAa,CAAC;AAGrB,OAAO,EAAE,YAAY,EAAE,KAAK,YAAY,IAAI,kBAAkB,EAAE,KAAK,aAAa,EAAE,KAAK,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAGrI,OAAO,EACL,eAAe,EACf,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,GACzB,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,gBAAgB,EAAE,KAAK,cAAc,EAAE,KAAK,aAAa,EAAE,KAAK,mBAAmB,EAAE,KAAK,eAAe,EAAE,KAAK,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAGnM,YAAY,EACV,SAAS,EACT,oBAAoB,EAEpB,YAAY,EACZ,cAAc,EACd,iBAAiB,EAEjB,KAAK,EACL,mBAAmB,EACnB,iBAAiB,EACjB,kBAAkB,EAElB,eAAe,EACf,oBAAoB,EAEpB,KAAK,EACL,gBAAgB,EAChB,kBAAkB,EAClB,aAAa,EACb,cAAc,EAEd,mBAAmB,EACnB,qBAAqB,EACrB,kBAAkB,EAClB,mBAAmB,EAEnB,4BAA4B,EAC5B,wBAAwB,EAExB,cAAc,EACd,UAAU,EACV,eAAe,EACf,iBAAiB,EAEjB,uBAAuB,EAEvB,gBAAgB,EAChB,mBAAmB,EACnB,eAAe,EACf,yBAAyB,EACzB,oBAAoB,EAEpB,kBAAkB,EAClB,oBAAoB,EACpB,gBAAgB,EAChB,kBAAkB,EAClB,cAAc,EAEd,MAAM,EACN,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EAEpB,WAAW,EACX,eAAe,EACf,OAAO,EACP,uBAAuB,EACvB,qBAAqB,EAErB,SAAS,EACT,YAAY,EACZ,QAAQ,EACR,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,EACpB,SAAS,EACT,mBAAmB,EACnB,qBAAqB,EACrB,sBAAsB,EAEtB,SAAS,EACT,qBAAqB,EACrB,gBAAgB,EAChB,mBAAmB,EAEnB,qBAAqB,EACrB,uBAAuB,EACvB,eAAe,EACf,0BAA0B,EAC1B,4BAA4B,EAC5B,wBAAwB,EACxB,0BAA0B,EAE1B,oBAAoB,EACpB,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,0BAA0B,EAE1B,iBAAiB,EACjB,4BAA4B,EAC5B,2BAA2B,EAC3B,sBAAsB,EACtB,qBAAqB,EACrB,kBAAkB,EAClB,YAAY,EACZ,cAAc,EAEd,aAAa,EACb,iBAAiB,EACjB,oBAAoB,EAEpB,kBAAkB,EAClB,oBAAoB,EACpB,WAAW,EACX,mBAAmB,EACnB,oBAAoB,EAEpB,2BAA2B,EAC3B,gCAAgC,EAChC,kBAAkB,EAClB,+BAA+B,EAE/B,0BAA0B,EAC1B,qBAAqB,EACrB,uBAAuB,EACvB,oBAAoB,EAEpB,kBAAkB,EAClB,kBAAkB,EAElB,6BAA6B,EAC7B,+BAA+B,GAChC,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -12,4 +12,6 @@ export { GrantexError, GrantexApiError, GrantexAuthError, GrantexTokenError, Gra
 export { EventsClient } from './resources/events.js';
 // Passports (MPP Agent Identity)
 export { PassportsClient, } from './resources/passports.js';
+// Scope enforcement
+export { ToolManifest, Permission, permissionCovers } from './manifest.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc;AACd,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAEtC,4DAA4D;AAC5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE/C,iCAAiC;AACjC,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAEtD,cAAc;AACd,OAAO,EAAE,YAAY,EAAsB,MAAM,WAAW,CAAC;AAE7D,gBAAgB;AAChB,OAAO,EACL,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,aAAa,CAAC;AAErB,kBAAkB;AAClB,OAAO,EAAE,YAAY,EAAkF,MAAM,uBAAuB,CAAC;AAErI,iCAAiC;AACjC,OAAO,EACL,eAAe,GAMhB,MAAM,0BAA0B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc;AACd,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAEtC,4DAA4D;AAC5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE/C,iCAAiC;AACjC,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAEtD,cAAc;AACd,OAAO,EAAE,YAAY,EAAsB,MAAM,WAAW,CAAC;AAE7D,gBAAgB;AAChB,OAAO,EACL,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,aAAa,CAAC;AAErB,kBAAkB;AAClB,OAAO,EAAE,YAAY,EAAkF,MAAM,uBAAuB,CAAC;AAErI,iCAAiC;AACjC,OAAO,EACL,eAAe,GAMhB,MAAM,0BAA0B,CAAC;AAElC,oBAAoB;AACpB,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,gBAAgB,EAA0H,MAAM,eAAe,CAAC"}

package/dist/manifest.d.ts

@@ -0,0 +1,126 @@
+/**
+ * Tool Manifest & Permission — scope enforcement for AI agent tool calls.
+ *
+ * A ToolManifest declares the permission level (read/write/delete/admin)
+ * required for each tool on a connector. The `enforce()` method on the
+ * Grantex client uses loaded manifests to check whether a grant token's
+ * scopes allow a given tool call.
+ *
+ * @example
+ * ```ts
+ * import { ToolManifest, Permission } from '@grantex/sdk';
+ *
+ * const manifest = new ToolManifest({
+ *   connector: 'salesforce',
+ *   tools: {
+ *     query: Permission.READ,
+ *     create_lead: Permission.WRITE,
+ *     delete_contact: Permission.DELETE,
+ *   },
+ * });
+ * ```
+ */
+/** Permission levels for tool operations. */
+export declare enum Permission {
+    READ = "read",
+    WRITE = "write",
+    DELETE = "delete",
+    ADMIN = "admin"
+}
+/**
+ * Check whether a granted permission level covers the required level.
+ *
+ * Hierarchy: `admin > delete > write > read`
+ *
+ * - A `write` scope covers `read` + `write` tools.
+ * - A `delete` scope covers `read` + `write` + `delete` tools.
+ * - An `admin` scope covers everything.
+ */
+export declare function permissionCovers(granted: string, required: string): boolean;
+export interface ToolManifestOptions {
+    /** Connector name (e.g., "salesforce", "hubspot"). */
+    connector: string;
+    /** Tool name → Permission mapping. */
+    tools: Record<string, Permission>;
+    /** Manifest version (default "1.0.0"). */
+    version?: string;
+    /** Human-readable description. */
+    description?: string;
+}
+/**
+ * Declares the required permission level for each tool on a connector.
+ *
+ * Load manifests via `grantex.loadManifest()` and they will be used
+ * automatically by `grantex.enforce()`.
+ */
+export declare class ToolManifest {
+    readonly connector: string;
+    readonly tools: Record<string, Permission>;
+    readonly version: string;
+    readonly description: string;
+    constructor(options: ToolManifestOptions);
+    /** Get the declared permission for a tool. Returns undefined if not found. */
+    getPermission(toolName: string): Permission | undefined;
+    /** Add or update a tool's permission in this manifest. */
+    addTool(toolName: string, permission: Permission): void;
+    /** Number of tools in this manifest. */
+    get toolCount(): number;
+    /**
+     * Create a ToolManifest from a JSON object (e.g., loaded from file).
+     *
+     * Expected shape:
+     * ```json
+     * { "connector": "salesforce", "tools": { "query": "read", ... } }
+     * ```
+     */
+    static fromJSON(data: Record<string, unknown>): ToolManifest;
+}
+/** Result of a `grantex.enforce()` call. */
+export interface EnforceResult {
+    /** Whether the tool call is permitted. */
+    allowed: boolean;
+    /** Human-readable reason if denied. */
+    reason: string;
+    /** Grant ID from the JWT (empty if token invalid). */
+    grantId: string;
+    /** Agent DID from the JWT (empty if token invalid). */
+    agentDid: string;
+    /** All scopes from the grant token. */
+    scopes: string[];
+    /** Resolved permission for the requested tool. */
+    permission: string;
+    /** Connector name. */
+    connector: string;
+    /** Tool name. */
+    tool: string;
+}
+/** Options for `grantex.enforce()`. */
+export interface EnforceOptions {
+    /** The Grantex grant token (JWT). */
+    grantToken: string;
+    /** Connector name (e.g., "salesforce"). */
+    connector: string;
+    /** Tool name (e.g., "delete_contact"). */
+    tool: string;
+    /** Amount for capped scope enforcement (optional). */
+    amount?: number;
+}
+/** Options for `grantex.wrapTool()`. */
+export interface WrapToolOptions {
+    /** Connector name. */
+    connector: string;
+    /** Tool name. */
+    tool: string;
+    /** Grant token — static string or getter function for dynamic tokens. */
+    grantToken: string | (() => string);
+}
+/** Options for `grantex.enforceMiddleware()`. */
+export interface EnforceMiddlewareOptions {
+    /** Extract the grant token from the request (e.g., from Authorization header). */
+    extractToken: (req: Record<string, unknown>) => string | undefined;
+    /** Extract the connector name from the request. */
+    extractConnector: (req: Record<string, unknown>) => string;
+    /** Extract the tool name from the request. */
+    extractTool: (req: Record<string, unknown>) => string;
+}
+//# sourceMappingURL=manifest.d.ts.map

package/dist/manifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAMH,6CAA6C;AAC7C,oBAAY,UAAU;IACpB,IAAI,SAAS;IACb,KAAK,UAAU;IACf,MAAM,WAAW;IACjB,KAAK,UAAU;CAChB;AASD;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAI3E;AAMD,MAAM,WAAW,mBAAmB;IAClC,sDAAsD;IACtD,SAAS,EAAE,MAAM,CAAC;IAClB,sCAAsC;IACtC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAClC,0CAA0C;IAC1C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;GAKG;AACH,qBAAa,YAAY;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC3C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;gBAEjB,OAAO,EAAE,mBAAmB;IAqBxC,8EAA8E;IAC9E,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS;IAIvD,0DAA0D;IAC1D,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,GAAG,IAAI;IAIvD,wCAAwC;IACxC,IAAI,SAAS,IAAI,MAAM,CAEtB;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,YAAY;CAa7D;AAMD,4CAA4C;AAC5C,MAAM,WAAW,aAAa;IAC5B,0CAA0C;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,uCAAuC;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,sDAAsD;IACtD,OAAO,EAAE,MAAM,CAAC;IAChB,uDAAuD;IACvD,QAAQ,EAAE,MAAM,CAAC;IACjB,uCAAuC;IACvC,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,kDAAkD;IAClD,UAAU,EAAE,MAAM,CAAC;IACnB,sBAAsB;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB;IACjB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,uCAAuC;AACvC,MAAM,WAAW,cAAc;IAC7B,qCAAqC;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,2CAA2C;IAC3C,SAAS,EAAE,MAAM,CAAC;IAClB,0CAA0C;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,sDAAsD;IACtD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wCAAwC;AACxC,MAAM,WAAW,eAAe;IAC9B,sBAAsB;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,yEAAyE;IACzE,UAAU,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,CAAC;CACrC;AAED,iDAAiD;AACjD,MAAM,WAAW,wBAAwB;IACvC,kFAAkF;IAClF,YAAY,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM,GAAG,SAAS,CAAC;IACnE,mDAAmD;IACnD,gBAAgB,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM,CAAC;IAC3D,8CAA8C;IAC9C,WAAW,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM,CAAC;CACvD"}