@odingard/guardian-sdk 0.0.0-stage → 0.1.0

package/dist-dts/contracts/files.d.ts

@@ -0,0 +1,61 @@
+import { z } from "zod";
+/**
+ * WO-013 — files surface. Representative read/write/share/delete through the
+ * file adapter on a deterministic local file store (lowest-burden provider).
+ */
+export declare const FILE_PATH_MAX_LENGTH = 512;
+export declare const FILE_CONTENT_MAX_LENGTH = 64000;
+export declare const FILE_GRANTEE_MAX_LENGTH = 256;
+export declare const FILE_ALLOWLIST_MAX_ENTRIES = 64;
+/**
+ * Canonical file path: `/` + non-empty segments of `[A-Za-z0-9._~-]`.
+ * No `.` or `..` segments, no `//`, no trailing slash, no root `/`.
+ * Canonical form is required so path/share allowlist prefix checks cannot
+ * be escaped by traversal or duplicate separators.
+ */
+export declare function isCanonicalFilePath(value: string): boolean;
+export declare const FilePathSchema: z.ZodString;
+/** Grantee / counterparty token: an opaque principal label (email or id). */
+export declare const CounterpartyTokenSchema: z.ZodString;
+export declare const FILE_READ_SCHEMA = "odingard.guardian.file.read.v1";
+export declare const FILE_WRITE_SCHEMA = "odingard.guardian.file.write.v1";
+export declare const FILE_SHARE_SCHEMA = "odingard.guardian.file.share.v1";
+export declare const FILE_DELETE_SCHEMA = "odingard.guardian.file.delete.v1";
+export declare const FileReadParametersV1Schema: z.ZodObject<{
+    schema: z.ZodLiteral<"odingard.guardian.file.read.v1">;
+    connectionId: z.core.$ZodBranded<z.ZodString, "ConnectionId", "out">;
+    path: z.ZodString;
+}, z.core.$strict>;
+export type FileReadParametersV1 = z.infer<typeof FileReadParametersV1Schema>;
+export declare const FileWriteParametersV1Schema: z.ZodObject<{
+    schema: z.ZodLiteral<"odingard.guardian.file.write.v1">;
+    connectionId: z.core.$ZodBranded<z.ZodString, "ConnectionId", "out">;
+    path: z.ZodString;
+    content: z.ZodString;
+}, z.core.$strict>;
+export type FileWriteParametersV1 = z.infer<typeof FileWriteParametersV1Schema>;
+export declare const FileShareParametersV1Schema: z.ZodObject<{
+    schema: z.ZodLiteral<"odingard.guardian.file.share.v1">;
+    connectionId: z.core.$ZodBranded<z.ZodString, "ConnectionId", "out">;
+    path: z.ZodString;
+    grantee: z.ZodString;
+    expiresAtEpochMs: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strict>;
+export type FileShareParametersV1 = z.infer<typeof FileShareParametersV1Schema>;
+export declare const FileDeleteParametersV1Schema: z.ZodObject<{
+    schema: z.ZodLiteral<"odingard.guardian.file.delete.v1">;
+    connectionId: z.core.$ZodBranded<z.ZodString, "ConnectionId", "out">;
+    path: z.ZodString;
+}, z.core.$strict>;
+export type FileDeleteParametersV1 = z.infer<typeof FileDeleteParametersV1Schema>;
+/**
+ * Fail-closed prefix match over canonical paths: `path` must equal an
+ * allowlist entry or sit under an entry that ends with `/`. A trailing-slash
+ * prefix cannot be escaped because `..` and `//` are excluded by canonical
+ * form.
+ */
+export declare function filePathWithinAllowlist(path: string, allowlist: readonly string[]): boolean;
+export declare function fileReadVerificationProjection(input: FileReadParametersV1): unknown;
+export declare function fileWriteVerificationProjection(input: FileWriteParametersV1): unknown;
+export declare function fileShareVerificationProjection(input: FileShareParametersV1): unknown;
+export declare function fileDeleteVerificationProjection(input: FileDeleteParametersV1): unknown;

package/dist-dts/contracts/identifiers.d.ts

@@ -0,0 +1,33 @@
+import { z } from "zod";
+export declare const TenantIdSchema: z.core.$ZodBranded<z.ZodString, "TenantId", "out">;
+export declare const PrincipalIdSchema: z.core.$ZodBranded<z.ZodString, "PrincipalId", "out">;
+export declare const AgentIdSchema: z.core.$ZodBranded<z.ZodString, "AgentId", "out">;
+export declare const GrantIdSchema: z.core.$ZodBranded<z.ZodString, "GrantId", "out">;
+export declare const PolicyIdSchema: z.core.$ZodBranded<z.ZodString, "PolicyId", "out">;
+export declare const RequestIdSchema: z.core.$ZodBranded<z.ZodString, "RequestId", "out">;
+export declare const ApprovalIdSchema: z.core.$ZodBranded<z.ZodString, "ApprovalId", "out">;
+export declare const CapabilityIdSchema: z.core.$ZodBranded<z.ZodString, "CapabilityId", "out">;
+export declare const CorrelationIdSchema: z.core.$ZodBranded<z.ZodString, "CorrelationId", "out">;
+export declare const EvidenceIdSchema: z.core.$ZodBranded<z.ZodString, "EvidenceId", "out">;
+export declare const AdapterIdSchema: z.core.$ZodBranded<z.ZodString, "AdapterId", "out">;
+export declare const ConnectionIdSchema: z.core.$ZodBranded<z.ZodString, "ConnectionId", "out">;
+export declare const AttemptIdSchema: z.core.$ZodBranded<z.ZodString, "AttemptId", "out">;
+export declare const BudgetIdSchema: z.core.$ZodBranded<z.ZodString, "BudgetId", "out">;
+export declare const TaskIdSchema: z.core.$ZodBranded<z.ZodString, "TaskId", "out">;
+export declare const NonceSchema: z.core.$ZodBranded<z.ZodString, "Nonce", "out">;
+export type TenantId = z.infer<typeof TenantIdSchema>;
+export type PrincipalId = z.infer<typeof PrincipalIdSchema>;
+export type AgentId = z.infer<typeof AgentIdSchema>;
+export type GrantId = z.infer<typeof GrantIdSchema>;
+export type PolicyId = z.infer<typeof PolicyIdSchema>;
+export type RequestId = z.infer<typeof RequestIdSchema>;
+export type ApprovalId = z.infer<typeof ApprovalIdSchema>;
+export type CapabilityId = z.infer<typeof CapabilityIdSchema>;
+export type CorrelationId = z.infer<typeof CorrelationIdSchema>;
+export type EvidenceId = z.infer<typeof EvidenceIdSchema>;
+export type AdapterId = z.infer<typeof AdapterIdSchema>;
+export type ConnectionId = z.infer<typeof ConnectionIdSchema>;
+export type AttemptId = z.infer<typeof AttemptIdSchema>;
+export type BudgetId = z.infer<typeof BudgetIdSchema>;
+export type TaskId = z.infer<typeof TaskIdSchema>;
+export type Nonce = z.infer<typeof NonceSchema>;

package/dist-dts/contracts/index.d.ts

@@ -0,0 +1,19 @@
+export * from "./action.js";
+export * from "./action-registry.js";
+export * from "./api.js";
+export * from "./action-parameters.js";
+export * from "./approval.js";
+export * from "./authority.js";
+export * from "./authority-state.js";
+export * from "./calendar.js";
+export * from "./canonical-json.js";
+export * from "./capability.js";
+export * from "./commerce.js";
+export * from "./digest.js";
+export * from "./identifiers.js";
+export * from "./evidence.js";
+export * from "./tools.js";
+export * from "./email.js";
+export * from "./execution.js";
+export * from "./files.js";
+export * from "./protected-data.js";

package/dist-dts/contracts/protected-data.d.ts

@@ -0,0 +1,93 @@
+import { z } from "zod";
+import { filePathWithinAllowlist } from "./files.js";
+/**
+ * WO-013 — protected data broker. The adapter injects protected values at
+ * execution time; the agent never receives reusable plaintext. The catalog
+ * below is declarative (which fields are protected, per connection /
+ * principal) — it is not a DLP or classification engine.
+ */
+export declare const PROTECTED_FIELD_REF_MAX_LENGTH = 64;
+export declare const PROTECTED_VALUE_MAX_LENGTH = 4096;
+export declare const PROTECTED_CATALOG_MAX_ENTRIES = 128;
+export declare const PROTECTED_USE_SINKS_MAX_ENTRIES = 16;
+export declare const PROTECTED_DISCLOSE_TARGETS_MAX_ENTRIES = 32;
+export declare const ProtectedFieldRefSchema: z.ZodString;
+export declare const ProtectedUseSinkSchema: z.ZodObject<{
+    connectionId: z.core.$ZodBranded<z.ZodString, "ConnectionId", "out">;
+    pathPrefix: z.ZodString;
+}, z.core.$strict>;
+export type ProtectedUseSink = z.infer<typeof ProtectedUseSinkSchema>;
+/** A declared protected field on one connection (per principal). */
+export declare const ProtectedCatalogEntrySchema: z.ZodObject<{
+    fieldRef: z.ZodString;
+    label: z.ZodString;
+    maskedPreview: z.ZodString;
+    allowUse: z.ZodBoolean;
+    allowView: z.ZodBoolean;
+    allowPersist: z.ZodBoolean;
+    useSinks: z.ZodArray<z.ZodObject<{
+        connectionId: z.core.$ZodBranded<z.ZodString, "ConnectionId", "out">;
+        pathPrefix: z.ZodString;
+    }, z.core.$strict>>;
+    discloseTargets: z.ZodArray<z.ZodString>;
+}, z.core.$strict>;
+export type ProtectedCatalogEntry = z.infer<typeof ProtectedCatalogEntrySchema>;
+export declare const ProtectedCatalogSchema: z.ZodArray<z.ZodObject<{
+    fieldRef: z.ZodString;
+    label: z.ZodString;
+    maskedPreview: z.ZodString;
+    allowUse: z.ZodBoolean;
+    allowView: z.ZodBoolean;
+    allowPersist: z.ZodBoolean;
+    useSinks: z.ZodArray<z.ZodObject<{
+        connectionId: z.core.$ZodBranded<z.ZodString, "ConnectionId", "out">;
+        pathPrefix: z.ZodString;
+    }, z.core.$strict>>;
+    discloseTargets: z.ZodArray<z.ZodString>;
+}, z.core.$strict>>;
+export type ProtectedCatalog = readonly ProtectedCatalogEntry[];
+export declare const PROTECTED_USE_SCHEMA = "odingard.guardian.protected-data.use.v1";
+export declare const PROTECTED_VIEW_SCHEMA = "odingard.guardian.protected-data.view.v1";
+export declare const PROTECTED_DISCLOSE_SCHEMA = "odingard.guardian.protected-data.disclose.v1";
+export declare const PROTECTED_PERSIST_SCHEMA = "odingard.guardian.protected-data.persist.v1";
+export declare const ProtectedUseParametersV1Schema: z.ZodObject<{
+    schema: z.ZodLiteral<"odingard.guardian.protected-data.use.v1">;
+    connectionId: z.core.$ZodBranded<z.ZodString, "ConnectionId", "out">;
+    fieldRef: z.ZodString;
+    sink: z.ZodObject<{
+        connectionId: z.core.$ZodBranded<z.ZodString, "ConnectionId", "out">;
+        path: z.ZodString;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type ProtectedUseParametersV1 = z.infer<typeof ProtectedUseParametersV1Schema>;
+export declare const ProtectedViewParametersV1Schema: z.ZodObject<{
+    schema: z.ZodLiteral<"odingard.guardian.protected-data.view.v1">;
+    connectionId: z.core.$ZodBranded<z.ZodString, "ConnectionId", "out">;
+    fieldRef: z.ZodString;
+}, z.core.$strict>;
+export type ProtectedViewParametersV1 = z.infer<typeof ProtectedViewParametersV1Schema>;
+export declare const ProtectedDiscloseParametersV1Schema: z.ZodObject<{
+    schema: z.ZodLiteral<"odingard.guardian.protected-data.disclose.v1">;
+    connectionId: z.core.$ZodBranded<z.ZodString, "ConnectionId", "out">;
+    fieldRef: z.ZodString;
+    counterparty: z.ZodString;
+}, z.core.$strict>;
+export type ProtectedDiscloseParametersV1 = z.infer<typeof ProtectedDiscloseParametersV1Schema>;
+export declare const ProtectedPersistParametersV1Schema: z.ZodObject<{
+    schema: z.ZodLiteral<"odingard.guardian.protected-data.persist.v1">;
+    connectionId: z.core.$ZodBranded<z.ZodString, "ConnectionId", "out">;
+    fieldRef: z.ZodString;
+    value: z.ZodString;
+}, z.core.$strict>;
+export type ProtectedPersistParametersV1 = z.infer<typeof ProtectedPersistParametersV1Schema>;
+export declare function protectedCatalogField(catalog: readonly ProtectedCatalogEntry[] | undefined, fieldRef: string): ProtectedCatalogEntry | null;
+/** use sink is authorized only by an exact declared sink binding. */
+export declare function protectedSinkWithinUseSinks(sink: {
+    connectionId: string;
+    path: string;
+}, useSinks: readonly ProtectedUseSink[]): boolean;
+export declare function protectedUseVerificationProjection(input: ProtectedUseParametersV1): unknown;
+export declare function protectedViewVerificationProjection(input: ProtectedViewParametersV1): unknown;
+export declare function protectedDiscloseVerificationProjection(input: ProtectedDiscloseParametersV1): unknown;
+export declare function protectedPersistVerificationProjection(input: ProtectedPersistParametersV1): unknown;
+export { filePathWithinAllowlist };

package/dist-dts/contracts/tools.d.ts

@@ -0,0 +1,187 @@
+import { z } from "zod";
+import { type ApiRequestParametersV1 } from "./api.js";
+/**
+ * WO-015 — tool / MCP authority surface.
+ *
+ * A "tool" is a named, human-installed entry in a tool server's catalog. Each
+ * entry renders to a bounded https call inside the owning connection's
+ * endpoint allowlist — the same transport surface as api.request (WO-009),
+ * with tool semantics layered on top by the action registry.
+ *
+ * `mcp.install` and `mcp.enable` are capability-expansion actions: they are
+ * registered so proposals resolve through the same deterministic decision
+ * path, but `requiresExplicitGrant` keeps them out of auto-derived grants.
+ * An agent can only ever receive them when a human selects them explicitly —
+ * self-serve escalation deterministically denies (WO-015 acceptance).
+ */
+export declare const TOOL_NAME_MAX_LENGTH = 64;
+export declare const TOOL_ARGUMENTS_MAX_BYTES = 16384;
+export declare const TOOL_CATALOG_MAX_TOOLS = 64;
+export declare const TOOL_SERVER_NAME_MAX_LENGTH = 128;
+export declare const TOOL_SERVER_VERSION_MAX_LENGTH = 64;
+export declare const TOOL_DESCRIPTION_MAX_LENGTH = 512;
+export declare const ToolNameSchema: z.ZodString;
+export type ToolName = z.infer<typeof ToolNameSchema>;
+/** A catalog entry: a named tool that renders to one allowlisted https call. */
+export declare const ToolDescriptorSchema: z.ZodObject<{
+    name: z.ZodString;
+    description: z.ZodOptional<z.ZodString>;
+    method: z.ZodEnum<{
+        GET: "GET";
+        HEAD: "HEAD";
+        POST: "POST";
+        PUT: "PUT";
+        PATCH: "PATCH";
+        DELETE: "DELETE";
+    }>;
+    url: z.ZodString;
+}, z.core.$strict>;
+export type ToolDescriptor = z.infer<typeof ToolDescriptorSchema>;
+/** The tool-server catalog stored on a provider "tool" connection record. */
+export declare const ToolServerCatalogSchema: z.ZodObject<{
+    serverName: z.ZodString;
+    serverVersion: z.ZodString;
+    tools: z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        description: z.ZodOptional<z.ZodString>;
+        method: z.ZodEnum<{
+            GET: "GET";
+            HEAD: "HEAD";
+            POST: "POST";
+            PUT: "PUT";
+            PATCH: "PATCH";
+            DELETE: "DELETE";
+        }>;
+        url: z.ZodString;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type ToolServerCatalog = z.infer<typeof ToolServerCatalogSchema>;
+/** Bounded canonical JSON object (cycles, prototypes and depth are rejected). */
+export declare const ToolArgumentsSchema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+export type ToolArguments = z.infer<typeof ToolArgumentsSchema>;
+export declare const ToolInvokeParametersV1Schema: z.ZodObject<{
+    schema: z.ZodLiteral<"odingard.guardian.tool.invoke.v1">;
+    connectionId: z.core.$ZodBranded<z.ZodString, "ConnectionId", "out">;
+    toolName: z.ZodString;
+    arguments: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+}, z.core.$strict>;
+export type ToolInvokeParametersV1 = z.infer<typeof ToolInvokeParametersV1Schema>;
+/**
+ * mcp.install registers an additional catalog entry on an existing, human-
+ * installed tool-server connection. It can never create a new connection or
+ * widen the endpoint allowlist — both stay human-only.
+ */
+export declare const McpInstallParametersV1Schema: z.ZodObject<{
+    schema: z.ZodLiteral<"odingard.guardian.mcp.install.v1">;
+    connectionId: z.core.$ZodBranded<z.ZodString, "ConnectionId", "out">;
+    tool: z.ZodObject<{
+        name: z.ZodString;
+        description: z.ZodOptional<z.ZodString>;
+        method: z.ZodEnum<{
+            GET: "GET";
+            HEAD: "HEAD";
+            POST: "POST";
+            PUT: "PUT";
+            PATCH: "PATCH";
+            DELETE: "DELETE";
+        }>;
+        url: z.ZodString;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type McpInstallParametersV1 = z.infer<typeof McpInstallParametersV1Schema>;
+/** mcp.enable enables a catalog tool for the requesting agent. */
+export declare const McpEnableParametersV1Schema: z.ZodObject<{
+    schema: z.ZodLiteral<"odingard.guardian.mcp.enable.v1">;
+    connectionId: z.core.$ZodBranded<z.ZodString, "ConnectionId", "out">;
+    toolName: z.ZodString;
+}, z.core.$strict>;
+export type McpEnableParametersV1 = z.infer<typeof McpEnableParametersV1Schema>;
+/**
+ * Renders an invocation to the canonical api.request envelope the adapter
+ * executes: the catalog method/url plus the arguments as a JSON body. Shared
+ * by the binding check and the execution adapter so both see one rendering.
+ */
+export declare function renderToolInvocation(tool: ToolDescriptor, args: ToolArguments): Omit<ApiRequestParametersV1, "schema" | "connectionId">;
+export declare function toolVerificationProjection(input: ToolInvokeParametersV1): Readonly<{
+    domain: "odingard.guardian.tool-invoke-projection.v1";
+    connectionId: string & z.core.$brand<"ConnectionId">;
+    toolName: string;
+    argumentsDigest: string;
+}>;
+/** Same single verification level as api.request (post-commit-content). */
+export declare function toolEnvelopeProjection(input: ToolInvokeParametersV1): Readonly<{
+    domain: "odingard.guardian.tool-invoke-projection.v1";
+    connectionId: string & z.core.$brand<"ConnectionId">;
+    toolName: string;
+    argumentsDigest: string;
+}>;
+export declare function mcpInstallProjection(input: McpInstallParametersV1): Readonly<{
+    domain: "odingard.guardian.mcp-projection.v1";
+    operation: "install";
+    connectionId: string & z.core.$brand<"ConnectionId">;
+    toolName: string;
+    descriptorDigest: string;
+}>;
+export declare function mcpEnableProjection(input: McpEnableParametersV1): Readonly<{
+    domain: "odingard.guardian.mcp-projection.v1";
+    operation: "enable";
+    connectionId: string & z.core.$brand<"ConnectionId">;
+    toolName: string;
+    descriptorDigest: null;
+}>;
+export declare function findCatalogTool(connection: {
+    toolServer?: {
+        tools: readonly {
+            name: string;
+        }[];
+    };
+}, toolName: string): {
+    name: string;
+} | undefined;
+/**
+ * Binding hooks shared by the three tool/MCP definitions. `connection` is the
+ * kernel-verified binding facts (catalog + per-agent enabled names).
+ */
+export declare function validateToolInvokeBinding(input: {
+    params: ToolInvokeParametersV1;
+    connection: {
+        toolServer?: {
+            tools: readonly ToolDescriptor[];
+        };
+        enabledToolNames?: readonly string[];
+        endpointAllowlist?: readonly string[];
+    };
+}): {
+    ok: true;
+} | {
+    ok: false;
+    reasonCode: string;
+};
+export declare function validateMcpInstallBinding(input: {
+    params: McpInstallParametersV1;
+    connection: {
+        toolServer?: {
+            tools: readonly ToolDescriptor[];
+        };
+        endpointAllowlist?: readonly string[];
+    };
+}): {
+    ok: true;
+} | {
+    ok: false;
+    reasonCode: string;
+};
+export declare function validateMcpEnableBinding(input: {
+    params: McpEnableParametersV1;
+    connection: {
+        toolServer?: {
+            tools: readonly ToolDescriptor[];
+        };
+        enabledToolNames?: readonly string[];
+    };
+}): {
+    ok: true;
+} | {
+    ok: false;
+    reasonCode: string;
+};

package/dist-dts/index.d.ts

@@ -0,0 +1 @@
+export { createGuardianClient, type GuardianClient, type GuardianClientConfig, type GuardianRequestResult, type GuardianToolInvocation, type GuardianMcpInvocation, } from "./client.js";

package/dist-dts/proposal.d.ts

@@ -0,0 +1,25 @@
+import { z } from "zod";
+export declare const AgentActionProposalSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    requestId: z.core.$ZodBranded<z.ZodString, "RequestId", "out">;
+    correlationId: z.core.$ZodBranded<z.ZodString, "CorrelationId", "out">;
+    action: z.core.$ZodBranded<z.ZodString, "ActionType", "out">;
+    resource: z.core.$ZodBranded<z.ZodString, "ResourceRef", "out">;
+    valueCents: z.ZodOptional<z.ZodNumber>;
+    merchantId: z.ZodOptional<z.ZodString>;
+    merchantCategory: z.ZodOptional<z.ZodString>;
+    recurring: z.ZodOptional<z.ZodBoolean>;
+    taskId: z.ZodOptional<z.core.$ZodBranded<z.ZodString, "TaskId", "out">>;
+    uses: z.ZodLiteral<1>;
+    materialParameters: z.ZodPipe<z.ZodUnknown, z.ZodTransform<Readonly<Record<string, import("./contracts/canonical-json.js").CanonicalJsonValue>>, unknown>>;
+    purpose: z.ZodString;
+    initiatingContext: z.ZodEnum<{
+        agent: "agent";
+        user: "user";
+        scheduled: "scheduled";
+        "external-event": "external-event";
+    }>;
+    requestedAdapterId: z.core.$ZodBranded<z.ZodString, "AdapterId", "out">;
+    requestedTtlMs: z.ZodNumber;
+}, z.core.$strict>;
+export type AgentActionProposal = z.infer<typeof AgentActionProposalSchema>;

package/package.json

@@ -1,6 +1,52 @@
 {
   "name": "@odingard/guardian-sdk",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0",
+  "description": "Guardian agent SDK — request governed capabilities and execute consequential actions under human authority.",
+  "license": "Apache-2.0",
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./dist-dts/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "dist-dts",
+    "README.md",
+    "LICENSE"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "esbuild src/index.ts --bundle --platform=node --format=esm --target=node22 --external:zod --outfile=dist/index.js && tsc -p tsconfig.build.json",
+    "test": "vitest run",
+    "prepublishOnly": "npm run build"
+  },
+  "dependencies": {
+    "zod": "4.6.5"
+  },
+  "devDependencies": {
+    "@types/node": "^22.20.5",
+    "esbuild": "0.28.2",
+    "typescript": "5.9.3",
+    "vitest": "3.2.4"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "keywords": [
+    "guardian",
+    "ai-agents",
+    "authorization",
+    "authority",
+    "mcp",
+    "human-in-the-loop"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/Odingard/guardian-sdk.git"
+  },
+  "homepage": "https://guardian.odingard.com"
+}