@grantex/sdk 0.5.1 → 0.7.0

package/LICENSE

@@ -0,0 +1,185 @@
+Copyright 2026 Orchestrum Technologies LLP.
+Grantex inventor and owner: Sanjeev Kumar <sanjeev@orchestrum.in> or <mishra.sanjeev@gmail.com>.
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship made available under
+      the License, as indicated by a copyright notice that is included in
+      or attached to the work (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean, as defined by the copyright owner or by an
+      individual or Legal Entity authorized to submit on behalf of the
+      copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any Legal Entity on behalf of
+      whom a Contribution has been received by the Licensor and subsequently
+      incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by the combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a cross-claim
+      or counterclaim in a lawsuit) alleging that the Work or any
+      Contribution embodied within the Work constitutes direct or contributory
+      patent infringement, then any patent licenses granted to You under
+      this License for that Work shall terminate as of the date such
+      litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or Derivative
+          Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, You must include a readable copy of the
+          attribution notices contained within such NOTICE file, in
+          at least one of the following places: within a NOTICE text
+          file distributed as part of the Derivative Works; within
+          the Source form or documentation, if provided along with the
+          Derivative Works; or, within a display generated by the
+          Derivative Works, if and wherever such third-party notices
+          normally appear. The contents of the NOTICE file are for
+          informational purposes only and do not modify the License.
+          You may add Your own attribution notices within Derivative
+          Works that You distribute, alongside or in addition to the
+          NOTICE text from the Work, provided that such additional
+          attribution notices cannot be construed as modifying the License.
+
+      You may add Your own license statement for Your modifications and
+      may provide additional grant of rights to use, copy, modify, merge,
+      publish, distribute, sublicense, and/or sell copies of the
+      Contribution, either on an inclusive or exclusive basis.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or reproducing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or exemplary damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or all other
+      commercial damages or losses), even if such Contributor has been
+      advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may offer such
+      conditions only on Your own behalf and on Your sole responsibility,
+      not on behalf of any other Contributor, and only if You agree to
+      indemnify, defend, and hold each Contributor harmless for any
+      liability incurred by, or claims asserted against, such Contributor
+      by reason of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   Copyright 2026 Grantex Contributors
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/NOTICE

@@ -0,0 +1,16 @@
+Grantex Ownership Notice
+
+Grantex is owned by Orchestrum Technologies LLP.
+
+Inventor and owner: Sanjeev Kumar.
+
+Ownership contact: sanjeev@orchestrum.in or mishra.sanjeev@gmail.com
+
+The Grantex protocol specification, source code, SDKs, examples, and
+documentation are made available under the Apache License 2.0 unless a file
+states otherwise. The open-source license does not remove or transfer the
+product ownership notice above.
+
+Third-party dependencies retain their own licenses. See
+https://github.com/mishrasanjeev/grantex/blob/main/THIRD_PARTY_NOTICES.md
+for reviewed distribution notices and obligations.

package/README.md

@@ -9,8 +9,18 @@ TypeScript SDK for the [Grantex](https://grantex.dev) delegated authorization pr
 
 ## Installation
 
+**Version 0.7.0:** adds hosted passkey enrollment sessions and
+account-level irregularity response policy methods. The server must enable the
+corresponding feature flags; this SDK does not register a passkey without an
+authenticated customer handoff. Version 0.6.0 added wallet clients that preserve the
+server's Base USDC `evmPayment` payload and expose `reconcileReservation()` for
+finalized settlement/expiry. Use `@grantex/x402@0.4.0` or later for
+the automatic 402/payment/retry flow. Confirm the published SDK version in
+[Release Status](https://docs.grantex.dev/release-status) before installing.
+See [Base custody setup](https://docs.grantex.dev/guides/base-usdc-custody).
+
 ```bash
-npm install @grantex/sdk
+npm install @grantex/sdk@0.7.0
 ```
 
 ## Quick Start
@@ -159,7 +169,7 @@ const agentWallets = new PrepaidWalletAgentClient({
 });
 
 const principalWallets = new PrincipalPrepaidWalletClient({
-  baseUrl: 'https://grantex.dev',
+  baseUrl: 'https://api.grantex.dev',
   sessionToken,
 });
 
@@ -708,6 +718,22 @@ console.log(pack.policies);
 
 ### Anomaly Detection
 
+In version 0.7.0, `grantex.anomalies.getResponsePolicy()` and
+`grantex.anomalies.setResponsePolicy('alert_only')` control the account-wide
+response of the legacy detector when the server operator enables
+`IRREGULARITY_RESPONSE_POLICY_ENABLED=true`. Default behavior revokes active
+grants for a high/critical finding's agent. Alert-only retains findings and
+events without that automatic revocation. This setting does not disable other
+security controls.
+
+Version 0.7.0 also supports
+`grantex.webauthn.createEnrollmentSession({ principalId, authRequestId? })`.
+Call it only on your server after authenticating the customer. Deliver the
+returned one-use hosted link to that exact customer; never expose the API key
+or log the link. Hosted enrollment requires the server's default-off
+`PASSKEY_ENROLLMENT_ENABLED=true` setting. Live consent has no password or
+sandbox fallback.
+
 #### `grantex.anomalies.detect()`
 
 Run anomaly detection across all agents.
@@ -940,3 +966,9 @@ const result = await grantex.enforce({ grantToken: token, connector: 'my-crm', t
 ## Ownership
 
 Grantex is owned by Orchestrum Technologies LLP. Inventor and owner: Sanjeev Kumar. Ownership contact: [sanjeev@orchestrum.in](mailto:sanjeev@orchestrum.in) or [mishra.sanjeev@gmail.com](mailto:mishra.sanjeev@gmail.com).
+
+## Source Development
+
+Use Node.js 24 LTS and `npm ci` to build or test this checkout with Vitest 5.
+Repository validation steps are in [the dependency upgrade guide](https://docs.grantex.dev/guides/dependency-updates).
+Source-tooling requirements are separate from published package runtime support.

package/dist/authorization-details.d.ts

@@ -0,0 +1,86 @@
+/**
+ * Read `urn:grantex:tools:v1` entries from a grant's `authorization_details`.
+ *
+ * This is the only place that interprets the `authorization_details` claim
+ * (RFC 9396), so a change to the token format touches one function. Shape:
+ *
+ * ```json
+ * "authorization_details": [{
+ *   "type": "urn:grantex:tools:v1",
+ *   "connector": "acme_kyb",
+ *   "purpose": "aml.cdd.onboarding",
+ *   "data_region": "eu",
+ *   "tools": ["resolve_business", "verify_business", "screen_*"],
+ *   "caps": {"verify_business": {"per_hour": 50, "per_case": 3},
+ *            "cost_units": {"per_day": 5000}}
+ * }]
+ * ```
+ *
+ * Entries of other types are separate authorizations and are ignored here. A
+ * tools entry constrains calls on its connector in addition to the grant's
+ * scopes. Anything ambiguous (a claim that is not an array, an entry without
+ * a string `type`, a tools entry with an unknown key, a value of the wrong
+ * type, or two tools entries for one connector) throws
+ * `AuthorizationDetailsError`, and `enforce()` denies. Mirrors the Python
+ * SDK's `grantex._authorization_details`.
+ *
+ * `caps` is validated here, for every call on the connector: each key is an
+ * exact tool name or `cost_units` (the connector's cost-unit budget), never a
+ * wildcard, and each value is a non-empty object of `per_hour`, `per_day` and
+ * `per_case` counts from 0 to 2147483647.
+ */
+export declare const TOOLS_DETAIL_TYPE = "urn:grantex:tools:v1";
+declare const CAP_WINDOWS: readonly ['per_hour', 'per_day', 'per_case'];
+/** Key of the connector cost-unit budget in `caps`; reserved as a tool name. */
+export declare const COST_UNITS_KEY = "cost_units";
+export type CapWindowCounts = Partial<Record<(typeof CAP_WINDOWS)[number], number>>;
+export declare class AuthorizationDetailsError extends Error {
+    constructor(message: string);
+}
+/** One `urn:grantex:tools:v1` entry. */
+export interface ToolsAuthorization {
+    connector: string;
+    /** The grant's purpose for this connector, exactly as issued (not validated). */
+    purpose?: string;
+    dataRegion?: string;
+    /** Tool names, or prefixes ending in `*`; absent means every tool. */
+    tools?: readonly string[];
+    /** Validated caps: tool name (or `cost_units`) to window to count. */
+    caps?: Readonly<Record<string, Readonly<CapWindowCounts>>>;
+}
+/** Whether an entry's `tools` list (when present) names `tool`. */
+export declare function toolsAuthorizationAllows(entry: ToolsAuthorization, tool: string): boolean;
+/**
+ * Return the tools entries of an `authorization_details` claim by connector.
+ * `undefined` or `null` (no claim) yields an empty map.
+ *
+ * @throws {AuthorizationDetailsError} the claim is malformed or ambiguous.
+ */
+export declare function parseToolsAuthorization(claim: unknown): Map<string, ToolsAuthorization>;
+export declare const DECISION_DETAIL_TYPE = "urn:grantex:decision:v1";
+/**
+ * One `urn:grantex:decision:v1` entry: tools on a connector that need a
+ * decision grant, and the decisions on each that need two approvers.
+ *
+ * ```json
+ * {"type": "urn:grantex:decision:v1", "connector": "acme_kyb",
+ *  "tools": ["case_decision"], "four_eyes_on": {"case_decision": ["decline"]}}
+ * ```
+ */
+export interface DecisionReference {
+    connector: string;
+    tools: readonly string[];
+    fourEyesOn: Readonly<Record<string, readonly string[]>>;
+}
+/**
+ * Return the decision references of an `authorization_details` claim by
+ * connector. `undefined` or `null` yields an empty map. Entries of other types
+ * are ignored.
+ *
+ * @throws {AuthorizationDetailsError} an entry is malformed: an unknown key, no
+ *   tools, a tool name that is not a name, `four_eyes_on` naming a tool not in
+ *   `tools`, or two entries for one connector.
+ */
+export declare function parseDecisionReferences(claim: unknown): Map<string, DecisionReference>;
+export {};
+//# sourceMappingURL=authorization-details.d.ts.map

package/dist/authorization-details.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-details.d.ts","sourceRoot":"","sources":["../src/authorization-details.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,eAAO,MAAM,iBAAiB,yBAAyB,CAAC;AAKxD,QAAA,MAAM,WAAW,YAAI,UAAU,EAAE,SAAS,EAAE,UAAU,CAAU,CAAC;AAGjE,gFAAgF;AAChF,eAAO,MAAM,cAAc,eAAe,CAAC;AAE3C,MAAM,MAAM,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;AAEpF,qBAAa,yBAA0B,SAAQ,KAAK;IAClD,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,wCAAwC;AACxC,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,iFAAiF;IACjF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,sEAAsE;IACtE,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,sEAAsE;IACtE,IAAI,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;CAC5D;AAmCD,mEAAmE;AACnE,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAGzF;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAmDvF;AAED,eAAO,MAAM,oBAAoB,4BAA4B,CAAC;AAM9D;;;;;;;;GAQG;AACH,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;CACzD;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAsDtF"}

package/dist/authorization-details.js

@@ -0,0 +1,209 @@
+/**
+ * Read `urn:grantex:tools:v1` entries from a grant's `authorization_details`.
+ *
+ * This is the only place that interprets the `authorization_details` claim
+ * (RFC 9396), so a change to the token format touches one function. Shape:
+ *
+ * ```json
+ * "authorization_details": [{
+ *   "type": "urn:grantex:tools:v1",
+ *   "connector": "acme_kyb",
+ *   "purpose": "aml.cdd.onboarding",
+ *   "data_region": "eu",
+ *   "tools": ["resolve_business", "verify_business", "screen_*"],
+ *   "caps": {"verify_business": {"per_hour": 50, "per_case": 3},
+ *            "cost_units": {"per_day": 5000}}
+ * }]
+ * ```
+ *
+ * Entries of other types are separate authorizations and are ignored here. A
+ * tools entry constrains calls on its connector in addition to the grant's
+ * scopes. Anything ambiguous (a claim that is not an array, an entry without
+ * a string `type`, a tools entry with an unknown key, a value of the wrong
+ * type, or two tools entries for one connector) throws
+ * `AuthorizationDetailsError`, and `enforce()` denies. Mirrors the Python
+ * SDK's `grantex._authorization_details`.
+ *
+ * `caps` is validated here, for every call on the connector: each key is an
+ * exact tool name or `cost_units` (the connector's cost-unit budget), never a
+ * wildcard, and each value is a non-empty object of `per_hour`, `per_day` and
+ * `per_case` counts from 0 to 2147483647.
+ */
+export const TOOLS_DETAIL_TYPE = 'urn:grantex:tools:v1';
+const ENTRY_KEYS = new Set(['type', 'connector', 'purpose', 'data_region', 'tools', 'caps']);
+const NAME_RE = /^[A-Za-z0-9_][A-Za-z0-9_.-]{0,127}$/;
+const TOOL_PATTERN_RE = /^[A-Za-z0-9_][A-Za-z0-9_.-]{0,127}\*?$/;
+const CAP_WINDOWS = ['per_hour', 'per_day', 'per_case'];
+const MAX_COUNT = 2147483647;
+/** Key of the connector cost-unit budget in `caps`; reserved as a tool name. */
+export const COST_UNITS_KEY = 'cost_units';
+export class AuthorizationDetailsError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'AuthorizationDetailsError';
+    }
+}
+function isPlainObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function parseCaps(raw, where) {
+    if (!isPlainObject(raw) || Object.keys(raw).length === 0) {
+        throw new AuthorizationDetailsError(`${where} must be a non-empty object`);
+    }
+    const parsed = {};
+    for (const [name, windows] of Object.entries(raw)) {
+        if (!(name === COST_UNITS_KEY || NAME_RE.test(name))) {
+            throw new AuthorizationDetailsError(`${where} key "${name}" must be an exact tool name or cost_units; wildcards are not allowed`);
+        }
+        if (!isPlainObject(windows) || Object.keys(windows).length === 0) {
+            throw new AuthorizationDetailsError(`${where}.${name} must be a non-empty object`);
+        }
+        const counts = {};
+        for (const [window, value] of Object.entries(windows)) {
+            if (!CAP_WINDOWS.includes(window)) {
+                throw new AuthorizationDetailsError(`${where}.${name} has unknown window "${window}"`);
+            }
+            if (typeof value !== 'number' || !Number.isInteger(value) || value < 0 || value > MAX_COUNT) {
+                throw new AuthorizationDetailsError(`${where}.${name}.${window} must be an integer between 0 and ${MAX_COUNT}`);
+            }
+            counts[window] = value;
+        }
+        Object.defineProperty(parsed, name, { value: Object.freeze(counts), enumerable: true, writable: false, configurable: false });
+    }
+    return parsed;
+}
+/** Whether an entry's `tools` list (when present) names `tool`. */
+export function toolsAuthorizationAllows(entry, tool) {
+    if (entry.tools === undefined)
+        return true;
+    return entry.tools.some((t) => (t.endsWith('*') ? tool.startsWith(t.slice(0, -1)) : t === tool));
+}
+/**
+ * Return the tools entries of an `authorization_details` claim by connector.
+ * `undefined` or `null` (no claim) yields an empty map.
+ *
+ * @throws {AuthorizationDetailsError} the claim is malformed or ambiguous.
+ */
+export function parseToolsAuthorization(claim) {
+    const entries = new Map();
+    if (claim === undefined || claim === null)
+        return entries;
+    if (!Array.isArray(claim))
+        throw new AuthorizationDetailsError('authorization_details must be an array');
+    claim.forEach((raw, index) => {
+        const where = `authorization_details[${index}]`;
+        if (!isPlainObject(raw))
+            throw new AuthorizationDetailsError(`${where} must be an object`);
+        const type = raw['type'];
+        if (typeof type !== 'string' || type.length === 0) {
+            throw new AuthorizationDetailsError(`${where}.type must be a non-empty string`);
+        }
+        if (type !== TOOLS_DETAIL_TYPE)
+            return;
+        const unknown = Object.keys(raw).filter((k) => !ENTRY_KEYS.has(k)).sort();
+        if (unknown.length > 0)
+            throw new AuthorizationDetailsError(`${where} has unknown key "${unknown[0]}"`);
+        const connector = raw['connector'];
+        if (typeof connector !== 'string' || !NAME_RE.test(connector)) {
+            throw new AuthorizationDetailsError(`${where}.connector must be a connector name`);
+        }
+        if (entries.has(connector)) {
+            throw new AuthorizationDetailsError(`${where} repeats connector "${connector}"; a grant carries one tools entry per connector`);
+        }
+        const entry = { connector };
+        const purpose = raw['purpose'];
+        if (purpose !== undefined && purpose !== null) {
+            if (typeof purpose !== 'string')
+                throw new AuthorizationDetailsError(`${where}.purpose must be a string`);
+            entry.purpose = purpose;
+        }
+        const dataRegion = raw['data_region'];
+        if (dataRegion !== undefined && dataRegion !== null) {
+            if (typeof dataRegion !== 'string')
+                throw new AuthorizationDetailsError(`${where}.data_region must be a string`);
+            entry.dataRegion = dataRegion;
+        }
+        if ('tools' in raw) {
+            const tools = raw['tools'];
+            if (!Array.isArray(tools) || !tools.every((t) => typeof t === 'string' && TOOL_PATTERN_RE.test(t))) {
+                throw new AuthorizationDetailsError(`${where}.tools must be an array of tool names or name prefixes ending in *`);
+            }
+            entry.tools = Object.freeze([...tools]);
+        }
+        if ('caps' in raw) {
+            entry.caps = Object.freeze(parseCaps(raw['caps'], `${where}.caps`));
+        }
+        entries.set(connector, entry);
+    });
+    return entries;
+}
+export const DECISION_DETAIL_TYPE = 'urn:grantex:decision:v1';
+const DECISION_ENTRY_KEYS = new Set(['type', 'connector', 'tools', 'four_eyes_on']);
+const TOOL_NAME_RE = NAME_RE;
+const DECISION_RE = /^[a-z][a-z0-9_]{0,63}$/;
+/**
+ * Return the decision references of an `authorization_details` claim by
+ * connector. `undefined` or `null` yields an empty map. Entries of other types
+ * are ignored.
+ *
+ * @throws {AuthorizationDetailsError} an entry is malformed: an unknown key, no
+ *   tools, a tool name that is not a name, `four_eyes_on` naming a tool not in
+ *   `tools`, or two entries for one connector.
+ */
+export function parseDecisionReferences(claim) {
+    const entries = new Map();
+    if (claim === undefined || claim === null)
+        return entries;
+    if (!Array.isArray(claim))
+        throw new AuthorizationDetailsError('authorization_details must be an array');
+    claim.forEach((raw, index) => {
+        const where = `authorization_details[${index}]`;
+        if (!isPlainObject(raw))
+            throw new AuthorizationDetailsError(`${where} must be an object`);
+        const type = raw['type'];
+        if (typeof type !== 'string' || type.length === 0) {
+            throw new AuthorizationDetailsError(`${where}.type must be a non-empty string`);
+        }
+        if (type !== DECISION_DETAIL_TYPE)
+            return;
+        const unknown = Object.keys(raw).filter((k) => !DECISION_ENTRY_KEYS.has(k)).sort();
+        if (unknown.length > 0)
+            throw new AuthorizationDetailsError(`${where} has unknown key "${unknown[0]}"`);
+        const connector = raw['connector'];
+        if (typeof connector !== 'string' || !NAME_RE.test(connector)) {
+            throw new AuthorizationDetailsError(`${where}.connector must be a connector name`);
+        }
+        if (entries.has(connector)) {
+            throw new AuthorizationDetailsError(`${where} repeats connector "${connector}"; a grant carries one decision entry per connector`);
+        }
+        const tools = raw['tools'];
+        if (!Array.isArray(tools) || tools.length === 0
+            || !tools.every((t) => typeof t === 'string' && TOOL_NAME_RE.test(t))) {
+            throw new AuthorizationDetailsError(`${where}.tools must be a non-empty array of tool names`);
+        }
+        const fourEyesOn = {};
+        if ('four_eyes_on' in raw) {
+            const rawFourEyes = raw['four_eyes_on'];
+            if (!isPlainObject(rawFourEyes)) {
+                throw new AuthorizationDetailsError(`${where}.four_eyes_on must be an object`);
+            }
+            for (const [tool, decisions] of Object.entries(rawFourEyes)) {
+                if (!tools.includes(tool)) {
+                    throw new AuthorizationDetailsError(`${where}.four_eyes_on names "${tool}", which is not in tools`);
+                }
+                if (!Array.isArray(decisions) || decisions.length === 0
+                    || !decisions.every((d) => typeof d === 'string' && DECISION_RE.test(d))) {
+                    throw new AuthorizationDetailsError(`${where}.four_eyes_on.${tool} must be a non-empty array of decisions`);
+                }
+                fourEyesOn[tool] = Object.freeze([...decisions]);
+            }
+        }
+        entries.set(connector, {
+            connector,
+            tools: Object.freeze([...tools]),
+            fourEyesOn: Object.freeze(fourEyesOn),
+        });
+    });
+    return entries;
+}
+//# sourceMappingURL=authorization-details.js.map

package/dist/authorization-details.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-details.js","sourceRoot":"","sources":["../src/authorization-details.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,sBAAsB,CAAC;AAExD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;AAC7F,MAAM,OAAO,GAAG,qCAAqC,CAAC;AACtD,MAAM,eAAe,GAAG,wCAAwC,CAAC;AACjE,MAAM,WAAW,GAAG,CAAC,UAAU,EAAE,SAAS,EAAE,UAAU,CAAU,CAAC;AACjE,MAAM,SAAS,GAAG,UAAU,CAAC;AAE7B,gFAAgF;AAChF,MAAM,CAAC,MAAM,cAAc,GAAG,YAAY,CAAC;AAI3C,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAClD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AAcD,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,SAAS,CAAC,GAAY,EAAE,KAAa;IAC5C,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,yBAAyB,CAAC,GAAG,KAAK,6BAA6B,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,MAAM,GAAoC,EAAE,CAAC;IACnD,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAClD,IAAI,CAAC,CAAC,IAAI,KAAK,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,yBAAyB,CACjC,GAAG,KAAK,SAAS,IAAI,uEAAuE,CAC7F,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACjE,MAAM,IAAI,yBAAyB,CAAC,GAAG,KAAK,IAAI,IAAI,6BAA6B,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,MAAM,GAAoB,EAAE,CAAC;QACnC,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACtD,IAAI,CAAE,WAAiC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBACzD,MAAM,IAAI,yBAAyB,CAAC,GAAG,KAAK,IAAI,IAAI,wBAAwB,MAAM,GAAG,CAAC,CAAC;YACzF,CAAC;YACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,SAAS,EAAE,CAAC;gBAC5F,MAAM,IAAI,yBAAyB,CAAC,GAAG,KAAK,IAAI,IAAI,IAAI,MAAM,qCAAqC,SAAS,EAAE,CAAC,CAAC;YAClH,CAAC;YACD,MAAM,CAAC,MAAsC,CAAC,GAAG,KAAK,CAAC;QACzD,CAAC;QACD,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;IAChI,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,wBAAwB,CAAC,KAAyB,EAAE,IAAY;IAC9E,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC3C,OAAO,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC;AACnG,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAc;IACpD,MAAM,OAAO,GAAG,IAAI,GAAG,EAA8B,CAAC;IACtD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC;IAC1D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,yBAAyB,CAAC,wCAAwC,CAAC,CAAC;IAEzG,KAAK,CAAC,OAAO,CAAC,CAAC,GAAY,EAAE,KAAK,EAAE,EAAE;QACpC,MAAM,KAAK,GAAG,yBAAyB,KAAK,GAAG,CAAC;QAChD,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,yBAAyB,CAAC,GAAG,KAAK,oBAAoB,CAAC,CAAC;QAC3F,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;QACzB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,yBAAyB,CAAC,GAAG,KAAK,kCAAkC,CAAC,CAAC;QAClF,CAAC;QACD,IAAI,IAAI,KAAK,iBAAiB;YAAE,OAAO;QAEvC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC1E,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,IAAI,yBAAyB,CAAC,GAAG,KAAK,qBAAqB,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAExG,MAAM,SAAS,GAAG,GAAG,CAAC,WAAW,CAAC,CAAC;QACnC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAI,yBAAyB,CAAC,GAAG,KAAK,qCAAqC,CAAC,CAAC;QACrF,CAAC;QACD,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,yBAAyB,CACjC,GAAG,KAAK,uBAAuB,SAAS,kDAAkD,CAC3F,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAuB,EAAE,SAAS,EAAE,CAAC;QAChD,MAAM,OAAO,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC;QAC/B,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YAC9C,IAAI,OAAO,OAAO,KAAK,QAAQ;gBAAE,MAAM,IAAI,yBAAyB,CAAC,GAAG,KAAK,2BAA2B,CAAC,CAAC;YAC1G,KAAK,CAAC,OAAO,GAAG,OAAO,CAAC;QAC1B,CAAC;QACD,MAAM,UAAU,GAAG,GAAG,CAAC,aAAa,CAAC,CAAC;QACtC,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;YACpD,IAAI,OAAO,UAAU,KAAK,QAAQ;gBAAE,MAAM,IAAI,yBAAyB,CAAC,GAAG,KAAK,+BAA+B,CAAC,CAAC;YACjH,KAAK,CAAC,UAAU,GAAG,UAAU,CAAC;QAChC,CAAC;QACD,IAAI,OAAO,IAAI,GAAG,EAAE,CAAC;YACnB,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC;YAC3B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnG,MAAM,IAAI,yBAAyB,CAAC,GAAG,KAAK,oEAAoE,CAAC,CAAC;YACpH,CAAC;YACD,KAAK,CAAC,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,GAAI,KAAkB,CAAC,CAAC,CAAC;QACxD,CAAC;QACD,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;YAClB,KAAK,CAAC,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,OAAO,CAAC,CAAC,CAAC;QACtE,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,MAAM,oBAAoB,GAAG,yBAAyB,CAAC;AAE9D,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC;AACpF,MAAM,YAAY,GAAG,OAAO,CAAC;AAC7B,MAAM,WAAW,GAAG,wBAAwB,CAAC;AAiB7C;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAc;IACpD,MAAM,OAAO,GAAG,IAAI,GAAG,EAA6B,CAAC;IACrD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC;IAC1D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,yBAAyB,CAAC,wCAAwC,CAAC,CAAC;IAEzG,KAAK,CAAC,OAAO,CAAC,CAAC,GAAY,EAAE,KAAK,EAAE,EAAE;QACpC,MAAM,KAAK,GAAG,yBAAyB,KAAK,GAAG,CAAC;QAChD,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,yBAAyB,CAAC,GAAG,KAAK,oBAAoB,CAAC,CAAC;QAC3F,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;QACzB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,yBAAyB,CAAC,GAAG,KAAK,kCAAkC,CAAC,CAAC;QAClF,CAAC;QACD,IAAI,IAAI,KAAK,oBAAoB;YAAE,OAAO;QAE1C,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACnF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,IAAI,yBAAyB,CAAC,GAAG,KAAK,qBAAqB,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACxG,MAAM,SAAS,GAAG,GAAG,CAAC,WAAW,CAAC,CAAC;QACnC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAI,yBAAyB,CAAC,GAAG,KAAK,qCAAqC,CAAC,CAAC;QACrF,CAAC;QACD,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,yBAAyB,CACjC,GAAG,KAAK,uBAAuB,SAAS,qDAAqD,CAC9F,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;eACxC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1E,MAAM,IAAI,yBAAyB,CAAC,GAAG,KAAK,gDAAgD,CAAC,CAAC;QAChG,CAAC;QACD,MAAM,UAAU,GAAsC,EAAE,CAAC;QACzD,IAAI,cAAc,IAAI,GAAG,EAAE,CAAC;YAC1B,MAAM,WAAW,GAAG,GAAG,CAAC,cAAc,CAAC,CAAC;YACxC,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,EAAE,CAAC;gBAChC,MAAM,IAAI,yBAAyB,CAAC,GAAG,KAAK,iCAAiC,CAAC,CAAC;YACjF,CAAC;YACD,KAAK,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC5D,IAAI,CAAE,KAAkB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;oBACxC,MAAM,IAAI,yBAAyB,CAAC,GAAG,KAAK,wBAAwB,IAAI,0BAA0B,CAAC,CAAC;gBACtG,CAAC;gBACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;uBAChD,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC7E,MAAM,IAAI,yBAAyB,CAAC,GAAG,KAAK,iBAAiB,IAAI,yCAAyC,CAAC,CAAC;gBAC9G,CAAC;gBACD,UAAU,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,GAAI,SAAsB,CAAC,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE;YACrB,SAAS;YACT,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAI,KAAkB,CAAC,CAAC;YAC9C,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC;SACtC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/canonical.d.ts

@@ -0,0 +1,47 @@
+/**
+ * JSON Canonicalization Scheme (RFC 8785).
+ *
+ * `canonicalize` turns a JSON value into its canonical text: object members
+ * sorted by the UTF-16 code units of their names, no insignificant
+ * whitespace, strings escaped as `JSON.stringify` escapes them and numbers in
+ * the ECMAScript `Number` format. Two values that differ only in member order,
+ * whitespace or number spelling canonicalise to the same text.
+ *
+ * The input must be I-JSON (RFC 7493). Anything without a single canonical
+ * form throws `CanonicalizationError` instead of being coerced or dropped:
+ * `NaN` and infinities; strings or member names with an unpaired surrogate;
+ * `undefined`, functions, symbols, bigints, sparse arrays and objects that
+ * are not plain objects (such as `Date` or `Map`, whose `toJSON` is not
+ * consulted); nesting deeper than `MAX_DEPTH`.
+ *
+ * The Python SDK implements the same rules in `grantex.canonical`; both are
+ * tested against the RFC 8785 test vectors and the shared fixtures in
+ * `spec/examples/canonicalization/`. Python additionally refuses integers
+ * whose digits are not the canonical form of a double (such as 2^53 + 1);
+ * a JavaScript number has already been rounded by the parser.
+ */
+/** Deepest nesting of arrays and objects accepted. */
+export declare const MAX_DEPTH = 64;
+/** The value has no RFC 8785 canonical form. */
+export declare class CanonicalizationError extends Error {
+    constructor(message: string);
+}
+/** Returns the RFC 8785 canonical JSON text of `value`. */
+export declare function canonicalize(value: unknown): string;
+/** Returns the RFC 8785 canonical JSON of `value` as UTF-8 bytes. */
+export declare function canonicalizeToBytes(value: unknown): Uint8Array;
+/** Serialises a finite number as `Number.prototype.toString` does (`-0` as `0`). */
+export declare function serializeNumber(value: number): string;
+/** A JSON text repeats a member name within one object. */
+export declare class DuplicateKeyError extends CanonicalizationError {
+    readonly key: string;
+    constructor(key: string);
+}
+/**
+ * Parses JSON text like `JSON.parse`, but throws `DuplicateKeyError` when an
+ * object repeats a member name (after unescaping), instead of silently keeping
+ * the last value. Use it wherever the raw text of a value to canonicalise is
+ * available.
+ */
+export declare function parseJsonRejectingDuplicates(text: string): unknown;
+//# sourceMappingURL=canonical.d.ts.map

package/dist/canonical.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical.d.ts","sourceRoot":"","sources":["../src/canonical.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,sDAAsD;AACtD,eAAO,MAAM,SAAS,KAAK,CAAC;AAE5B,gDAAgD;AAChD,qBAAa,qBAAsB,SAAQ,KAAK;IAC9C,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAID,2DAA2D;AAC3D,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAInD;AAED,qEAAqE;AACrE,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,UAAU,CAE9D;AAED,oFAAoF;AACpF,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAMrD;AA+DD,2DAA2D;AAC3D,qBAAa,iBAAkB,SAAQ,qBAAqB;IAC1D,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,YAAY,GAAG,EAAE,MAAM,EAItB;CACF;AAED;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CA6BlE"}