GET /api/catalog
GET /api/inventory?pid=name
POST /api/grant {pid, asset, src}
POST /api/revoke {pid, asset}
/client.js