nxtid-sdk 0.1.0__tar.gz

nxtid_sdk-0.1.0/PKG-INFO

@@ -0,0 +1,6 @@
+Metadata-Version: 2.4
+Name: nxtid-sdk
+Version: 0.1.0
+Summary: nxtID Python SDK — AIT-gated AI agent tool permissions
+Requires-Python: >=3.10
+Requires-Dist: httpx>=0.27

nxtid_sdk-0.1.0/README.md

@@ -0,0 +1,319 @@
+# nxtID Python SDK
+
+Python SDK for integrating **MetaKeep wallet**, **AuthID biometric IDV**, and **nxtlinq AIT on-chain permissions** into AI agents.
+
+---
+
+## Installation
+
+```bash
+pip install nxtid-sdk
+```
+
+---
+
+## Quick Start
+
+```python
+from nxtid_sdk import NxtidSDK
+
+sdk = NxtidSDK(
+    api_key="your-api-key",
+    api_secret="your-api-secret",
+    env="production",          # "production" (default) or "staging"
+    service_id="your-service-id",  # required for log_chat
+)
+
+# 1. Register your agent's tools on startup
+await sdk.register_tools([
+    {"name": "get_account_balance", "description": "Read-only finance access"},
+    {"name": "transfer_funds",      "description": "Move money between accounts"},
+])
+
+# 2. Connect wallet by email
+wallet = await sdk.connect_wallet(email="user@example.com")
+# → WalletResult(wallet_address="0x...", email="user@example.com")
+
+# 3. Start AuthID identity verification
+verify = await sdk.start_verification(wallet.wallet_address)
+# → VerifyStartResult(flow="login"|"onboarding"|"choose_document", widget_url="...", ...)
+
+# 4. After user completes the widget
+result = await sdk.complete_verification(
+    wallet.wallet_address,
+    operation_id=verify.operation_id,   # for onboarding flow
+    transaction_id=verify.transaction_id,  # for login flow
+)
+# → VerifyCompleteResult(is_verified=True)
+
+# 5. Check admin-granted permissions
+perms = await sdk.get_permissions(wallet.wallet_address)
+if perms.has_permission("transfer_funds"):
+    ...
+```
+
+---
+
+## Environments
+
+| env           | AIT Service                            | Dashboard                           |
+|---------------|----------------------------------------|-------------------------------------|
+| `production`  | `https://ait-service.nxtlinq.ai`       | `https://dashboard.nxtlinq.ai`      |
+| `staging`     | `https://staging-ait-service.nxtlinq.ai` | `https://dashboard-staging.nxtlinq.ai` |
+
+---
+
+## API Reference
+
+### `NxtidSDK`
+
+```python
+NxtidSDK(
+    api_key: str,
+    api_secret: str,
+    env: str = "production",
+    service_id: Optional[str] = None,
+)
+```
+
+Credentials (`api_key`, `api_secret`, `service_id`) are obtained from nxtID Dashboard → **Services → Register Third-party Agent**.
+
+---
+
+#### `connect_wallet(email) → WalletResult`
+
+Gets or creates a MetaKeep non-custodial wallet for the given email address.
+
+```python
+wallet = await sdk.connect_wallet(email="user@example.com")
+wallet.wallet_address  # "0xABCDEF..."
+wallet.email           # "user@example.com"
+```
+
+---
+
+#### `start_verification(wallet_address, id_type=None) → VerifyStartResult`
+
+Starts an AuthID identity verification session.
+
+| `flow`              | Condition                                      |
+|---------------------|------------------------------------------------|
+| `"login"`           | Returning user (face scan only)                |
+| `"onboarding"`      | New user with `id_type` provided               |
+| `"choose_document"` | New user without `id_type` (user selects type) |
+
+`id_type` is the AuthID document type code (e.g. `"40"` for passport).
+
+```python
+result = await sdk.start_verification(wallet.wallet_address, id_type="40")
+result.flow        # "onboarding"
+result.widget_url  # URL to open in browser/iframe
+result.operation_id   # pass to complete_verification (onboarding)
+result.transaction_id # pass to complete_verification (login)
+```
+
+---
+
+#### `complete_verification(wallet_address, operation_id=None, transaction_id=None) → VerifyCompleteResult`
+
+Finalises the verification session after the user completes the widget. Polls AuthID for up to 60 s.
+
+```python
+done = await sdk.complete_verification(
+    wallet.wallet_address,
+    operation_id=result.operation_id,
+)
+done.is_verified  # True | False
+```
+
+---
+
+#### `get_permissions(wallet_address) → PermissionsResult`
+
+Queries the AIT on-chain record for this wallet to determine which tools the admin has granted.
+
+```python
+perms = await sdk.get_permissions(wallet.wallet_address)
+perms.allowed        # True if any permission grant exists
+perms.allowed_tools  # ["transfer_funds", "get_account_balance", ...]
+perms.denied_tools   # tools explicitly blocked
+perms.reason         # optional explanation from nxtlinq
+
+perms.has_permission("transfer_funds")  # True | False
+```
+
+---
+
+#### `get_admin_granted_tools(wallet_address) → list[str]`
+
+Returns the list of tools the admin has pre-approved for this user to self-service request. Empty list means the admin hasn't granted any tools yet.
+
+```python
+tools = await sdk.get_admin_granted_tools(wallet.wallet_address)
+# ["calculate", "get_company_info", "get_account_balance"]
+```
+
+---
+
+#### `set_permissions(wallet_address, permissions, granted_by=None) → dict`
+
+Writes an AIT on-chain with the given tool list for `wallet_address`. Used for self-service permission requests (user selects a subset of admin-granted tools).
+
+```python
+await sdk.set_permissions(
+    wallet_address="0x...",
+    permissions=["calculate", "get_company_info"],
+    granted_by="user@example.com",
+)
+```
+
+---
+
+#### `register_tools(tools) → int`
+
+Registers the agent's tool catalogue with nxtID so admins can grant permissions per tool. Call once at agent startup.
+
+```python
+count = await sdk.register_tools([
+    {"name": "transfer_funds",      "description": "Move money between accounts"},
+    {"name": "get_account_balance", "description": "Read-only finance access"},
+])
+# count = 2
+```
+
+---
+
+#### `log_chat(...) → None`
+
+Sends one conversation turn to nxtID Dashboard for monitoring. Fails silently — logging is non-fatal. Requires `service_id` at SDK init time.
+
+```python
+await sdk.log_chat(
+    session_id="abc123",
+    user_message="What's my balance?",
+    assistant_message="Your balance is $500.",
+    external_user_id="user@example.com",
+    user_name="Alice",
+    model="meta/llama-3.3-70b-instruct",
+    has_tool_call=True,
+    tool_name="get_account_balance",
+    turn_index=0,
+)
+```
+
+---
+
+### `EntraAuth`
+
+Optional module for adding Microsoft Entra SSO login to a FastAPI agent. When enabled, mounts two routes onto the host app that the browser MSAL popup calls.
+
+```python
+from nxtid_sdk import EntraAuth
+
+entra = EntraAuth(
+    client_id=os.getenv("AZURE_AD_CLIENT_ID"),
+    tenant_id=os.getenv("AZURE_AD_TENANT_ID"),
+    get_session=get_or_create_session,  # callable: session_id → Session object
+)
+entra.mount(app)  # app is a FastAPI instance
+```
+
+If `client_id` or `tenant_id` is empty/`None`, `entra.enabled` returns `False` and the routes respond accordingly — no error is raised.
+
+**Routes mounted:**
+
+| Method | Path                | Description                                      |
+|--------|---------------------|--------------------------------------------------|
+| `GET`  | `/auth/entra/config`| Returns `{ enabled, client_id, tenant_id }` for MSAL initialisation |
+| `POST` | `/auth/entra`       | Receives MSAL token claims, writes session state |
+
+**POST `/auth/entra` body:**
+
+```json
+{
+  "session_id": "string",
+  "name": "string",
+  "email": "string",
+  "tenant_id": "string (optional)",
+  "roles": ["string"]
+}
+```
+
+The `get_session` callable receives a `session_id` string and must return a session object with writable attributes: `entra_authenticated`, `entra_name`, `entra_email`, `entra_tenant_id`, `entra_roles`.
+
+---
+
+### `ToolCallBlockedError`
+
+Exception raised to block a tool execution before it reaches the LLM tool handler.
+
+```python
+from nxtid_sdk import ToolCallBlockedError
+
+try:
+    await guard_tool_call(tool_name, session_id)
+except ToolCallBlockedError as exc:
+    exc.reason   # "verification_required" | "permission_denied"
+    exc.message  # user-facing explanation
+```
+
+**Factory method:**
+
+```python
+raise ToolCallBlockedError.permission_denied(
+    tool_name="transfer_funds",
+    allowed_tools=["calculate", "get_company_info"],
+)
+# message: "You don't have permission to use 'transfer_funds'.
+#           Your current permissions: [calculate, get_company_info].
+#           Contact your administrator."
+```
+
+---
+
+### Return Types
+
+| Class                | Fields                                                                 |
+|----------------------|------------------------------------------------------------------------|
+| `WalletResult`       | `wallet_address: str`, `email: str`                                    |
+| `VerifyStartResult`  | `flow: str`, `widget_url: str\|None`, `operation_id: str\|None`, `transaction_id: str\|None` |
+| `VerifyCompleteResult` | `is_verified: bool`                                                  |
+| `PermissionsResult`  | `allowed: bool`, `allowed_tools: list[str]`, `denied_tools: list[str]`, `reason: str\|None`, `has_permission(tool_name) → bool` |
+
+---
+
+## Typical Agent Integration Pattern
+
+```python
+# main.py (FastAPI)
+from nxtid_sdk import NxtidSDK, EntraAuth, ToolCallBlockedError
+
+sdk = NxtidSDK(api_key=..., api_secret=..., env="staging", service_id=...)
+
+entra = EntraAuth(
+    client_id=os.getenv("AZURE_AD_CLIENT_ID"),
+    tenant_id=os.getenv("AZURE_AD_TENANT_ID"),
+    get_session=get_or_create_session,
+)
+entra.mount(app)
+
+@app.on_event("startup")
+async def startup():
+    await sdk.register_tools(TOOL_DEFINITIONS)
+
+# In your tool dispatcher:
+async def guard_tool_call(tool_name: str, session_id: str) -> None:
+    ctx = get_identity_context(session_id)
+    if not ctx.is_verified:
+        raise ToolCallBlockedError("verification_required", "Complete identity verification first.")
+    if tool_name not in ctx.allowed_tools:
+        raise ToolCallBlockedError.permission_denied(tool_name, ctx.allowed_tools)
+```
+
+---
+
+## Requirements
+
+- Python ≥ 3.10
+- `httpx >= 0.27`
+- FastAPI (only required for `EntraAuth`)

nxtid_sdk-0.1.0/nxtid_sdk/__init__.py

@@ -0,0 +1,5 @@
+from .client import NxtidSDK
+from .entra import EntraAuth
+from .exceptions import ToolCallBlockedError
+
+__all__ = ["NxtidSDK", "EntraAuth", "ToolCallBlockedError"]

nxtid_sdk-0.1.0/nxtid_sdk/client.py

@@ -0,0 +1,355 @@
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+from typing import Optional
+
+import httpx
+
+
+def _raise_for_status(resp: httpx.Response) -> None:
+    """Like raise_for_status() but includes the response body in the exception message."""
+    if resp.is_error:
+        try:
+            detail = resp.json()
+        except Exception:
+            detail = resp.text
+        raise httpx.HTTPStatusError(
+            f"Client error '{resp.status_code} {resp.reason_phrase}' for url '{resp.url}' — {detail}",
+            request=resp.request,
+            response=resp,
+        )
+
+
+@dataclass
+class WalletResult:
+    wallet_address: str
+    email: str
+
+
+@dataclass
+class VerifyStartResult:
+    flow: str  # 'onboarding' | 'login' | 'choose_document'
+    widget_url: Optional[str] = None
+    operation_id: Optional[str] = None
+    transaction_id: Optional[str] = None
+
+
+@dataclass
+class VerifyCompleteResult:
+    is_verified: bool
+
+
+@dataclass
+class PermissionsResult:
+    allowed: bool
+    allowed_tools: list[str] = field(default_factory=list)
+    denied_tools: list[str] = field(default_factory=list)
+    reason: Optional[str] = None
+
+    def has_permission(self, tool_name: str) -> bool:
+        if not self.allowed:
+            return False
+        if not self.allowed_tools or "ALL" in self.allowed_tools:
+            return True
+        return tool_name in self.allowed_tools
+
+
+_ENV_URLS: dict[str, dict[str, str]] = {
+    "production": {
+        "ait": "https://ait-service.nxtlinq.ai",
+        "dashboard": "https://dashboard.nxtlinq.ai",
+    },
+    "staging": {
+        "ait": "https://staging-ait-service.nxtlinq.ai",
+        "dashboard": "https://dashboard-staging.nxtlinq.ai",
+    },
+}
+
+
+class NxtidSDK:
+    """
+    nxtID Python SDK.
+
+    Provides wallet connection, AuthID identity verification, and AIT
+    permission checks.
+
+    Usage::
+
+        sdk = NxtidSDK(
+            api_key="...",
+            api_secret="...",
+            env="production",        # "production" (default) or "staging"
+            service_id="your-service-id",  # optional, for log_chat
+        )
+
+        # Register tools on startup
+        await sdk.register_tools([{"name": "transfer_funds", "description": "..."}])
+
+        # Connect wallet
+        wallet = await sdk.connect_wallet(email="user@example.com")
+
+        # Start IDV (returns widget URL for the user to complete)
+        verify = await sdk.start_verification(wallet.wallet_address, id_type="40")
+
+        # After user completes the widget:
+        result = await sdk.complete_verification(
+            wallet.wallet_address,
+            operation_id=verify.operation_id,
+        )
+
+        # Check AIT permissions
+        perms = await sdk.get_permissions(wallet.wallet_address)
+        if perms.has_permission("transfer_funds"):
+            ...
+    """
+
+    def __init__(
+        self,
+        api_key: str,
+        api_secret: str,
+        env: str = "production",
+        service_id: Optional[str] = None,
+    ) -> None:
+        if env not in _ENV_URLS:
+            raise ValueError(f"env must be 'production' or 'staging', got '{env}'")
+        urls = _ENV_URLS[env]
+        self._base_url = urls["ait"]
+        self._dashboard_url = urls["dashboard"]
+        self._service_id = service_id
+        self._headers = {
+            "x-api-key": api_key,
+            "x-api-secret": api_secret,
+            "Content-Type": "application/json",
+        }
+
+    def _url(self, path: str) -> str:
+        return f"{self._base_url}{path}"
+
+    def _dashboard_api_url(self, path: str) -> str:
+        if not self._dashboard_url:
+            raise ValueError("dashboard_url is required for this operation")
+        return f"{self._dashboard_url}{path}"
+
+    # ── Wallet ────────────────────────────────────────────────────────────────
+
+    async def connect_wallet(self, email: str) -> WalletResult:
+        """Get (or create) a MetaKeep-managed wallet for the given email."""
+        async with httpx.AsyncClient(timeout=30.0) as client:
+            resp = await client.post(
+                self._url("/api/wallet/connect"),
+                json={"email": email},
+                headers=self._headers,
+            )
+        _raise_for_status(resp)
+        data = resp.json()
+        return WalletResult(wallet_address=data["walletAddress"], email=data["email"])
+
+    # ── Verification ──────────────────────────────────────────────────────────
+
+    async def start_verification(
+        self,
+        wallet_address: str,
+        id_type: Optional[str] = None,
+    ) -> VerifyStartResult:
+        """
+        Start AuthID identity verification.
+
+        Returns a widget URL for the user to open in a browser or iframe.
+        - Returning users:  flow='login'          (face scan)
+        - New users:        flow='onboarding'      (document capture, id_type required)
+        - New users w/o id_type: flow='choose_document' (prompt user to pick)
+        """
+        body: dict = {"walletAddress": wallet_address}
+        if id_type:
+            body["idType"] = id_type
+
+        async with httpx.AsyncClient(timeout=30.0) as client:
+            resp = await client.post(
+                self._url("/api/verify/start"),
+                json=body,
+                headers=self._headers,
+            )
+        _raise_for_status(resp)
+        data = resp.json()
+        return VerifyStartResult(
+            flow=data["flow"],
+            widget_url=data.get("widgetUrl"),
+            operation_id=data.get("operationId"),
+            transaction_id=data.get("transactionId"),
+        )
+
+    async def complete_verification(
+        self,
+        wallet_address: str,
+        operation_id: Optional[str] = None,
+        transaction_id: Optional[str] = None,
+    ) -> VerifyCompleteResult:
+        """
+        Call after the user completes the AuthID widget.
+
+        Pass operation_id (onboarding flow) or transaction_id (login flow)
+        from the VerifyStartResult.
+        """
+        body: dict = {"walletAddress": wallet_address}
+        if operation_id:
+            body["operationId"] = operation_id
+        if transaction_id:
+            body["transactionId"] = transaction_id
+
+        # Generous timeout: complete_verification polls AuthID for up to 60s
+        async with httpx.AsyncClient(timeout=90.0) as client:
+            resp = await client.post(
+                self._url("/api/verify/complete"),
+                json=body,
+                headers=self._headers,
+            )
+        _raise_for_status(resp)
+        data = resp.json()
+        return VerifyCompleteResult(is_verified=data["isVerified"])
+
+    # ── Permissions ───────────────────────────────────────────────────────────
+
+    async def set_permissions(
+        self,
+        wallet_address: str,
+        permissions: list[str],
+        granted_by: Optional[str] = None,
+    ) -> dict:
+        """
+        Create an AIT on-chain with the given permissions for wallet_address.
+
+        requested_by: email or identifier of whoever triggered this request —
+                      stored in the AIT record for audit purposes. Optional;
+                      existing callers that omit it are unaffected.
+        """
+        body: dict = {"address": wallet_address, "permissions": permissions}
+        if granted_by:
+            body["grantedBy"] = granted_by
+
+        async with httpx.AsyncClient(timeout=60.0) as client:
+            resp = await client.post(
+                self._url("/api/ait/set-permissions"),
+                json=body,
+                headers=self._headers,
+            )
+        _raise_for_status(resp)
+        return resp.json()
+
+    async def get_admin_granted_tools(self, wallet_address: str) -> list[str]:
+        """
+        Return the tools admin has pre-approved for this user to self-service request.
+
+        Empty list means admin hasn't granted this user any tools yet — the caller
+        should show "waiting for administrator" rather than checkboxes.
+        """
+        async with httpx.AsyncClient(timeout=15.0) as client:
+            resp = await client.get(
+                self._url("/api/agent/permissions"),
+                params={"walletAddress": wallet_address},
+                headers=self._headers,
+            )
+        _raise_for_status(resp)
+        return resp.json().get("allowedTools", [])
+
+    async def get_permissions(self, wallet_address: str) -> PermissionsResult:
+        """Query admin-granted AIT tool permissions for the given wallet address."""
+        async with httpx.AsyncClient(timeout=15.0) as client:
+            resp = await client.get(
+                self._url("/api/agent/user-permission"),
+                params={"walletAddress": wallet_address},
+                headers=self._headers,
+            )
+        _raise_for_status(resp)
+        data = resp.json()
+        return PermissionsResult(
+            allowed=data.get("allowed", False),
+            allowed_tools=data.get("allowedTools", []),
+            denied_tools=data.get("deniedTools", []),
+            reason=data.get("reason"),
+        )
+
+    # ── Agent management ─────────────────────────────────────────────────────
+
+    async def register_tools(self, tools: list) -> int:
+        """
+        Register this agent's tool list with nxtlinq so admins can grant permissions.
+
+        Call once at agent startup. Each tool should be a dict with 'name' and
+        optionally 'description'.
+
+        Returns the number of tools registered.
+
+        Usage::
+
+            tool_count = await sdk.register_tools([
+                {"name": "transfer_funds", "description": "Move money between accounts"},
+                {"name": "get_account_balance", "description": "Read-only finance access"},
+            ])
+        """
+        async with httpx.AsyncClient(timeout=15.0) as client:
+            resp = await client.post(
+                self._url("/api/agent/tools"),
+                json={"tools": tools},
+                headers=self._headers,
+            )
+        _raise_for_status(resp)
+        return resp.json().get("toolCount", len(tools))
+
+    async def log_chat(
+        self,
+        session_id: str,
+        user_message: str,
+        assistant_message: str,
+        external_user_id: str,
+        user_name: str,
+        model: str = "",
+        has_tool_call: bool = False,
+        tool_name: str = "",
+        turn_index: Optional[int] = None,
+    ) -> None:
+        """
+        Send one conversation turn to the nxtlinq Dashboard for monitoring.
+
+        Requires dashboard_url and service_id to be set at SDK init time.
+        Fails silently — chat logging is non-fatal.
+
+        Usage::
+
+            await sdk.log_chat(
+                session_id="abc123",
+                user_message="What's my balance?",
+                assistant_message="Your balance is $500.",
+                external_user_id="user@example.com",
+                user_name="Alice",
+                has_tool_call=True,
+                tool_name="get_account_balance",
+            )
+        """
+        if not self._dashboard_url or not self._service_id:
+            return
+        payload: dict = {
+            "aiType": model,
+            "hasToolCall": has_tool_call,
+            "toolName": tool_name,
+            "userInfo": {
+                "externalUserId": external_user_id,
+                "userName": user_name,
+            },
+            "chatHistory": {
+                "externalChatHistoryId": session_id,
+                "userMessage": user_message,
+                "assistantMessage": assistant_message,
+            },
+        }
+        if turn_index is not None:
+            payload["chatHistory"]["externalTurnIndex"] = turn_index
+        try:
+            async with httpx.AsyncClient(timeout=10.0) as client:
+                await client.post(
+                    self._dashboard_api_url(f"/api/service/{self._service_id}/external-service-call-log"),
+                    json=payload,
+                    headers=self._headers,
+                )
+        except Exception:
+            pass
+

nxtid_sdk-0.1.0/nxtid_sdk/entra.py

@@ -0,0 +1,91 @@
+from __future__ import annotations
+
+from typing import List, Optional
+
+from fastapi import APIRouter
+from fastapi.responses import JSONResponse
+from pydantic import BaseModel
+
+
+class EntraAuth:
+    """
+    Optional Microsoft Entra SSO module for the nxtID SDK.
+
+    When enabled, mounts two FastAPI routes onto the host app:
+      GET  /auth/entra/config  — returns client_id/tenant_id for MSAL
+      POST /auth/entra         — receives MSAL token claims, writes session state
+
+    Usage::
+
+        from nxtid_sdk import EntraAuth
+
+        entra = EntraAuth(
+            client_id="...",
+            tenant_id="...",
+            get_session=get_or_create_session,   # callable: session_id -> Session
+        )
+        entra.mount(app)                         # app is a FastAPI instance
+
+        # Check if enabled
+        if entra.enabled:
+            ...
+    """
+
+    def __init__(
+        self,
+        client_id: Optional[str],
+        tenant_id: Optional[str],
+        get_session,
+    ) -> None:
+        self._client_id = client_id or ""
+        self._tenant_id = tenant_id or ""
+        self._get_session = get_session
+
+    @property
+    def enabled(self) -> bool:
+        return bool(self._client_id and self._tenant_id)
+
+    def mount(self, app) -> None:
+        """Mount /auth/entra/config and /auth/entra routes onto a FastAPI app."""
+        router = self._build_router()
+        app.include_router(router)
+
+    def _build_router(self) -> APIRouter:
+        router = APIRouter()
+        client_id = self._client_id
+        tenant_id = self._tenant_id
+        enabled = self.enabled
+        get_session = self._get_session
+
+        class _EntraAuthRequest(BaseModel):
+            session_id: str
+            name: str
+            email: str
+            tenant_id: Optional[str] = None
+            roles: List[str] = []
+
+        @router.get("/auth/entra/config")
+        async def entra_config() -> dict:
+            return {
+                "enabled": enabled,
+                "client_id": client_id,
+                "tenant_id": tenant_id,
+            }
+
+        @router.post("/auth/entra")
+        async def auth_entra(req: _EntraAuthRequest) -> dict:
+            session = get_session(req.session_id)
+            session.entra_authenticated = True
+            session.entra_name = req.name
+            session.entra_email = req.email
+            session.entra_tenant_id = req.tenant_id
+            session.entra_roles = req.roles
+            return {
+                "session_id": session.session_id,
+                "entra_authenticated": True,
+                "name": req.name,
+                "email": req.email,
+                "roles": req.roles,
+            }
+
+        return router

nxtid_sdk-0.1.0/nxtid_sdk/exceptions.py

@@ -0,0 +1,24 @@
+from __future__ import annotations
+
+
+class ToolCallBlockedError(Exception):
+    """
+    Raised to block a tool execution before it reaches the LLM tool handler.
+
+    reason: 'verification_required' | 'permission_denied'
+    message: user-facing explanation
+    """
+
+    def __init__(self, reason: str, message: str) -> None:
+        self.reason = reason
+        self.message = message
+
+    @classmethod
+    def permission_denied(cls, tool_name: str, allowed_tools: list[str]) -> "ToolCallBlockedError":
+        tools_str = ", ".join(allowed_tools) if allowed_tools else "none"
+        return cls(
+            "permission_denied",
+            f"You don't have permission to use '{tool_name}'. "
+            f"Your current permissions: [{tools_str}]. "
+            "Contact your administrator.",
+        )

nxtid_sdk-0.1.0/nxtid_sdk.egg-info/PKG-INFO

@@ -0,0 +1,6 @@
+Metadata-Version: 2.4
+Name: nxtid-sdk
+Version: 0.1.0
+Summary: nxtID Python SDK — AIT-gated AI agent tool permissions
+Requires-Python: >=3.10
+Requires-Dist: httpx>=0.27

nxtid_sdk-0.1.0/nxtid_sdk.egg-info/SOURCES.txt

@@ -0,0 +1,11 @@
+README.md
+pyproject.toml
+nxtid_sdk/__init__.py
+nxtid_sdk/client.py
+nxtid_sdk/entra.py
+nxtid_sdk/exceptions.py
+nxtid_sdk.egg-info/PKG-INFO
+nxtid_sdk.egg-info/SOURCES.txt
+nxtid_sdk.egg-info/dependency_links.txt
+nxtid_sdk.egg-info/requires.txt
+nxtid_sdk.egg-info/top_level.txt

nxtid_sdk-0.1.0/nxtid_sdk.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

nxtid_sdk-0.1.0/nxtid_sdk.egg-info/requires.txt

@@ -0,0 +1 @@
+httpx>=0.27

nxtid_sdk-0.1.0/nxtid_sdk.egg-info/top_level.txt

@@ -0,0 +1 @@
+nxtid_sdk

nxtid_sdk-0.1.0/pyproject.toml

@@ -0,0 +1,16 @@
+[build-system]
+requires = ["setuptools>=68"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "nxtid-sdk"
+version = "0.1.0"
+description = "nxtID Python SDK — AIT-gated AI agent tool permissions"
+requires-python = ">=3.10"
+dependencies = [
+    "httpx>=0.27",
+]
+
+[tool.setuptools.packages.find]
+where = ["."]
+include = ["nxtid_sdk*"]

nxtid_sdk-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+